{
  "description": "Machine-readable source of truth for all validation rules. When adding a new rule, add it here AND in VALIDATION-RULES.md. CI parity tests enforce sync.",
  "version": "1.1.0",
  "total_rules": 426,
  "last_updated": "2026-06-21",
  "schema": {
    "evidence": {
      "source_type": "spec|vendor_docs|vendor_code|paper|community",
      "source_urls": [
        "array of URLs"
      ],
      "verified_on": "ISO date string",
      "applies_to": {
        "tool": "tool name (optional)",
        "version_range": "semver range (optional)",
        "spec_revision": "spec version (optional)"
      },
      "normative_level": "MUST|SHOULD|BEST_PRACTICE",
      "tests": {
        "unit": "boolean",
        "fixtures": "boolean",
        "e2e": "boolean"
      }
    },
    "fix": {
      "autofix": "boolean - whether this rule has an automatic fix",
      "fix_safety": "safe|unsafe|safe/unsafe (only present when autofix is true)"
    },
    "good_example": "string - valid config snippet that passes this rule (optional, falls back to category template)",
    "bad_example": "string - invalid config snippet that triggers this rule (optional, falls back to category template)"
  },
  "rules": [
    {
      "id": "AGM-001",
      "name": "Valid Markdown Structure",
      "severity": "HIGH",
      "category": "agents-md",
      "evidence": {
        "source_type": "community",
        "source_urls": [
          "https://developers.openai.com/codex/guides/agents-md",
          "https://cursor.com/docs/rules",
          "https://docs.cline.bot/prompting/cline-memory-bank#cline-memory-bank-custom-instructions-[copy-this]"
        ],
        "verified_on": "2026-02-09",
        "applies_to": {},
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe"
      },
      "good_example": "# Project\n\n```python\ndef hello():\n    print(\"world\")\n```\n\nSee [docs](https://example.com) for more.",
      "bad_example": "# Project\n\n```python\ndef hello():\n    print(\"world\")\n\nThis code block is never closed."
    },
    {
      "id": "AGM-002",
      "name": "Missing Section Headers",
      "severity": "MEDIUM",
      "category": "agents-md",
      "evidence": {
        "source_type": "community",
        "source_urls": [
          "https://cursor.com/docs/rules",
          "https://docs.cline.bot/prompting/cline-memory-bank#cline-memory-bank-custom-instructions-[copy-this]"
        ],
        "verified_on": "2026-02-09",
        "applies_to": {},
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "# Main Title\n\nSome content here.\n\n## Section\n\nMore content.",
      "bad_example": "Just plain text without any headers.\nNo structure at all.\nHard to navigate."
    },
    {
      "id": "AGM-003",
      "name": "Character Limit (Windsurf)",
      "severity": "MEDIUM",
      "category": "agents-md",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://docs.windsurf.com/windsurf/cascade/memories"
        ],
        "verified_on": "2026-02-09",
        "applies_to": {
          "tool": "windsurf"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "# Project\n\nConcise agent instructions that stay well under the 12000 character limit.\n\n## Commands\n\n- npm test\n- npm build",
      "bad_example": "# Project\n\n- Configuration rule 1: ensure all environment variables are documented and validated at startup.\n- Configuration rule 2: ensure all environment variables are documented and validated at startup.\n- Configuration rule 3: ensure all environment variables are documented and validated at startup.\n- Configuration rule 4: ensure all environment variables are documented and validated at startup.\n- Configuration rule 5: ensure all environment variables are documented and validated at startup.\n- Configuration rule 6: ensure all environment variables are documented and validated at startup.\n- Configuration rule 7: ensure all environment variables are documented and validated at startup.\n- Configuration rule 8: ensure all environment variables are documented and validated at startup.\n- Configuration rule 9: ensure all environment variables are documented and validated at startup.\n- Configuration rule 10: ensure all environment variables are documented and validated at startup.\n- Configuration rule 11: ensure all environment variables are documented and validated at startup.\n- Configuration rule 12: ensure all environment variables are documented and validated at startup.\n- Configuration rule 13: ensure all environment variables are documented and validated at startup.\n- Configuration rule 14: ensure all environment variables are documented and validated at startup.\n- Configuration rule 15: ensure all environment variables are documented and validated at startup.\n- Configuration rule 16: ensure all environment variables are documented and validated at startup.\n- Configuration rule 17: ensure all environment variables are documented and validated at startup.\n- Configuration rule 18: ensure all environment variables are documented and validated at startup.\n- Configuration rule 19: ensure all environment variables are documented and validated at startup.\n- Configuration rule 20: ensure all environment variables are documented and validated at startup.\n- Configuration rule 21: ensure all environment variables are documented and validated at startup.\n- Configuration rule 22: ensure all environment variables are documented and validated at startup.\n- Configuration rule 23: ensure all environment variables are documented and validated at startup.\n- Configuration rule 24: ensure all environment variables are documented and validated at startup.\n- Configuration rule 25: ensure all environment variables are documented and validated at startup.\n- Configuration rule 26: ensure all environment variables are documented and validated at startup.\n- Configuration rule 27: ensure all environment variables are documented and validated at startup.\n- Configuration rule 28: ensure all environment variables are documented and validated at startup.\n- Configuration rule 29: ensure all environment variables are documented and validated at startup.\n- Configuration rule 30: ensure all environment variables are documented and validated at startup.\n- Configuration rule 31: ensure all environment variables are documented and validated at startup.\n- Configuration rule 32: ensure all environment variables are documented and validated at startup.\n- Configuration rule 33: ensure all environment variables are documented and validated at startup.\n- Configuration rule 34: ensure all environment variables are documented and validated at startup.\n- Configuration rule 35: ensure all environment variables are documented and validated at startup.\n- Configuration rule 36: ensure all environment variables are documented and validated at startup.\n- Configuration rule 37: ensure all environment variables are documented and validated at startup.\n- Configuration rule 38: ensure all environment variables are documented and validated at startup.\n- Configuration rule 39: ensure all environment variables are documented and validated at startup.\n- Configuration rule 40: ensure all environment variables are documented and validated at startup.\n- Configuration rule 41: ensure all environment variables are documented and validated at startup.\n- Configuration rule 42: ensure all environment variables are documented and validated at startup.\n- Configuration rule 43: ensure all environment variables are documented and validated at startup.\n- Configuration rule 44: ensure all environment variables are documented and validated at startup.\n- Configuration rule 45: ensure all environment variables are documented and validated at startup.\n- Configuration rule 46: ensure all environment variables are documented and validated at startup.\n- Configuration rule 47: ensure all environment variables are documented and validated at startup.\n- Configuration rule 48: ensure all environment variables are documented and validated at startup.\n- Configuration rule 49: ensure all environment variables are documented and validated at startup.\n- Configuration rule 50: ensure all environment variables are documented and validated at startup.\n- Configuration rule 51: ensure all environment variables are documented and validated at startup.\n- Configuration rule 52: ensure all environment variables are documented and validated at startup.\n- Configuration rule 53: ensure all environment variables are documented and validated at startup.\n- Configuration rule 54: ensure all environment variables are documented and validated at startup.\n- Configuration rule 55: ensure all environment variables are documented and validated at startup.\n- Configuration rule 56: ensure all environment variables are documented and validated at startup.\n- Configuration rule 57: ensure all environment variables are documented and validated at startup.\n- Configuration rule 58: ensure all environment variables are documented and validated at startup.\n- Configuration rule 59: ensure all environment variables are documented and validated at startup.\n- Configuration rule 60: ensure all environment variables are documented and validated at startup.\n- Configuration rule 61: ensure all environment variables are documented and validated at startup.\n- Configuration rule 62: ensure all environment variables are documented and validated at startup.\n- Configuration rule 63: ensure all environment variables are documented and validated at startup.\n- Configuration rule 64: ensure all environment variables are documented and validated at startup.\n- Configuration rule 65: ensure all environment variables are documented and validated at startup.\n- Configuration rule 66: ensure all environment variables are documented and validated at startup.\n- Configuration rule 67: ensure all environment variables are documented and validated at startup.\n- Configuration rule 68: ensure all environment variables are documented and validated at startup.\n- Configuration rule 69: ensure all environment variables are documented and validated at startup.\n- Configuration rule 70: ensure all environment variables are documented and validated at startup.\n- Configuration rule 71: ensure all environment variables are documented and validated at startup.\n- Configuration rule 72: ensure all environment variables are documented and validated at startup.\n- Configuration rule 73: ensure all environment variables are documented and validated at startup.\n- Configuration rule 74: ensure all environment variables are documented and validated at startup.\n- Configuration rule 75: ensure all environment variables are documented and validated at startup.\n- Configuration rule 76: ensure all environment variables are documented and validated at startup.\n- Configuration rule 77: ensure all environment variables are documented and validated at startup.\n- Configuration rule 78: ensure all environment variables are documented and validated at startup.\n- Configuration rule 79: ensure all environment variables are documented and validated at startup.\n- Configuration rule 80: ensure all environment variables are documented and validated at startup.\n- Configuration rule 81: ensure all environment variables are documented and validated at startup.\n- Configuration rule 82: ensure all environment variables are documented and validated at startup.\n- Configuration rule 83: ensure all environment variables are documented and validated at startup.\n- Configuration rule 84: ensure all environment variables are documented and validated at startup.\n- Configuration rule 85: ensure all environment variables are documented and validated at startup.\n- Configuration rule 86: ensure all environment variables are documented and validated at startup.\n- Configuration rule 87: ensure all environment variables are documented and validated at startup.\n- Configuration rule 88: ensure all environment variables are documented and validated at startup.\n- Configuration rule 89: ensure all environment variables are documented and validated at startup.\n- Configuration rule 90: ensure all environment variables are documented and validated at startup.\n- Configuration rule 91: ensure all environment variables are documented and validated at startup.\n- Configuration rule 92: ensure all environment variables are documented and validated at startup.\n- Configuration rule 93: ensure all environment variables are documented and validated at startup.\n- Configuration rule 94: ensure all environment variables are documented and validated at startup.\n- Configuration rule 95: ensure all environment variables are documented and validated at startup.\n- Configuration rule 96: ensure all environment variables are documented and validated at startup.\n- Configuration rule 97: ensure all environment variables are documented and validated at startup.\n- Configuration rule 98: ensure all environment variables are documented and validated at startup.\n- Configuration rule 99: ensure all environment variables are documented and validated at startup.\n- Configuration rule 100: ensure all environment variables are documented and validated at startup.\n- Configuration rule 101: ensure all environment variables are documented and validated at startup.\n- Configuration rule 102: ensure all environment variables are documented and validated at startup.\n- Configuration rule 103: ensure all environment variables are documented and validated at startup.\n- Configuration rule 104: ensure all environment variables are documented and validated at startup.\n- Configuration rule 105: ensure all environment variables are documented and validated at startup.\n- Configuration rule 106: ensure all environment variables are documented and validated at startup.\n- Configuration rule 107: ensure all environment variables are documented and validated at startup.\n- Configuration rule 108: ensure all environment variables are documented and validated at startup.\n- Configuration rule 109: ensure all environment variables are documented and validated at startup.\n- Configuration rule 110: ensure all environment variables are documented and validated at startup.\n- Configuration rule 111: ensure all environment variables are documented and validated at startup.\n- Configuration rule 112: ensure all environment variables are documented and validated at startup.\n- Configuration rule 113: ensure all environment variables are documented and validated at startup.\n- Configuration rule 114: ensure all environment variables are documented and validated at startup.\n- Configuration rule 115: ensure all environment variables are documented and validated at startup.\n- Configuration rule 116: ensure all environment variables are documented and validated at startup.\n- Configuration rule 117: ensure all environment variables are documented and validated at startup.\n- Configuration rule 118: ensure all environment variables are documented and validated at startup.\n- Configuration rule 119: ensure all environment variables are documented and validated at startup.\n- Configuration rule 120: ensure all environment variables are documented and validated at startup.\n- Configuration rule 121: ensure all environment variables are documented and validated at startup.\n- Configuration rule 122: ensure all environment variables are documented and validated at startup.\n- Configuration rule 123: ensure all environment variables are documented and validated at startup.\n- Configuration rule 124: ensure all environment variables are documented and validated at startup.\n- Configuration rule 125: ensure all environment variables are documented and validated at startup.\n- Configuration rule 126: ensure all environment variables are documented and validated at startup.\n- Configuration rule 127: ensure all environment variables are documented and validated at startup.\n- Configuration rule 128: ensure all environment variables are documented and validated at startup.\n- Configuration rule 129: ensure all environment variables are documented and validated at startup.\n- Configuration rule 130: ensure all environment variables are documented and validated at startup.\n- Configuration rule 131: ensure all environment variables are documented and validated at startup.\n- Configuration rule 132: ensure all environment variables are documented and validated at startup.\n- Configuration rule 133: ensure all environment variables are documented and validated at startup.\n- Configuration rule 134: ensure all environment variables are documented and validated at startup.\n- Configuration rule 135: ensure all environment variables are documented and validated at startup.\n- Configuration rule 136: ensure all environment variables are documented and validated at startup.\n- Configuration rule 137: ensure all environment variables are documented and validated at startup.\n- Configuration rule 138: ensure all environment variables are documented and validated at startup.\n- Configuration rule 139: ensure all environment variables are documented and validated at startup.\n- Configuration rule 140: ensure all environment variables are documented and validated at startup.\n- Configuration rule 141: ensure all environment variables are documented and validated at startup.\n- Configuration rule 142: ensure all environment variables are documented and validated at startup.\n- Configuration rule 143: ensure all environment variables are documented and validated at startup.\n- Configuration rule 144: ensure all environment variables are documented and validated at startup.\n- Configuration rule 145: ensure all environment variables are documented and validated at startup.\n- Configuration rule 146: ensure all environment variables are documented and validated at startup.\n- Configuration rule 147: ensure all environment variables are documented and validated at startup.\n- Configuration rule 148: ensure all environment variables are documented and validated at startup.\n- Configuration rule 149: ensure all environment variables are documented and validated at startup.\n- Configuration rule 150: ensure all environment variables are documented and validated at startup.\n- Configuration rule 151: ensure all environment variables are documented and validated at startup.\n- Configuration rule 152: ensure all environment variables are documented and validated at startup.\n- Configuration rule 153: ensure all environment variables are documented and validated at startup.\n- Configuration rule 154: ensure all environment variables are documented and validated at startup.\n- Configuration rule 155: ensure all environment variables are documented and validated at startup.\n- Configuration rule 156: ensure all environment variables are documented and validated at startup.\n- Configuration rule 157: ensure all environment variables are documented and validated at startup.\n- Configuration rule 158: ensure all environment variables are documented and validated at startup.\n- Configuration rule 159: ensure all environment variables are documented and validated at startup.\n- Configuration rule 160: ensure all environment variables are documented and validated at startup.\n- Configuration rule 161: ensure all environment variables are documented and validated at startup.\n- Configuration rule 162: ensure all environment variables are documented and validated at startup.\n- Configuration rule 163: ensure all environment variables are documented and validated at startup.\n- Configuration rule 164: ensure all environment variables are documented and validated at startup.\n- Configuration rule 165: ensure all environment variables are documented and validated at startup.\n- Configuration rule 166: ensure all environment variables are documented and validated at startup.\n- Configuration rule 167: ensure all environment variables are documented and validated at startup.\n- Configuration rule 168: ensure all environment variables are documented and validated at startup.\n- Configuration rule 169: ensure all environment variables are documented and validated at startup.\n- Configuration rule 170: ensure all environment variables are documented and validated at startup.\n- Configuration rule 171: ensure all environment variables are documented and validated at startup.\n- Configuration rule 172: ensure all environment variables are documented and validated at startup.\n- Configuration rule 173: ensure all environment variables are documented and validated at startup.\n- Configuration rule 174: ensure all environment variables are documented and validated at startup.\n- Configuration rule 175: ensure all environment variables are documented and validated at startup.\n- Configuration rule 176: ensure all environment variables are documented and validated at startup.\n- Configuration rule 177: ensure all environment variables are documented and validated at startup.\n- Configuration rule 178: ensure all environment variables are documented and validated at startup.\n- Configuration rule 179: ensure all environment variables are documented and validated at startup.\n- Configuration rule 180: ensure all environment variables are documented and validated at startup.\n- Configuration rule 181: ensure all environment variables are documented and validated at startup.\n- Configuration rule 182: ensure all environment variables are documented and validated at startup.\n- Configuration rule 183: ensure all environment variables are documented and validated at startup.\n- Configuration rule 184: ensure all environment variables are documented and validated at startup.\n- Configuration rule 185: ensure all environment variables are documented and validated at startup.\n- Configuration rule 186: ensure all environment variables are documented and validated at startup.\n- Configuration rule 187: ensure all environment variables are documented and validated at startup.\n- Configuration rule 188: ensure all environment variables are documented and validated at startup.\n- Configuration rule 189: ensure all environment variables are documented and validated at startup.\n- Configuration rule 190: ensure all environment variables are documented and validated at startup.\n- Configuration rule 191: ensure all environment variables are documented and validated at startup.\n- Configuration rule 192: ensure all environment variables are documented and validated at startup.\n- Configuration rule 193: ensure all environment variables are documented and validated at startup.\n- Configuration rule 194: ensure all environment variables are documented and validated at startup.\n- Configuration rule 195: ensure all environment variables are documented and validated at startup.\n- Configuration rule 196: ensure all environment variables are documented and validated at startup.\n- Configuration rule 197: ensure all environment variables are documented and validated at startup.\n- Configuration rule 198: ensure all environment variables are documented and validated at startup.\n- Configuration rule 199: ensure all environment variables are documented and validated at startup.\n- Configuration rule 200: ensure all environment variables are documented and validated at startup.\n- Configuration rule 201: ensure all environment variables are documented and validated at startup.\n- Configuration rule 202: ensure all environment variables are documented and validated at startup.\n- Configuration rule 203: ensure all environment variables are documented and validated at startup.\n- Configuration rule 204: ensure all environment variables are documented and validated at startup.\n- Configuration rule 205: ensure all environment variables are documented and validated at startup.\n- Configuration rule 206: ensure all environment variables are documented and validated at startup.\n- Configuration rule 207: ensure all environment variables are documented and validated at startup.\n- Configuration rule 208: ensure all environment variables are documented and validated at startup.\n- Configuration rule 209: ensure all environment variables are documented and validated at startup.\n- Configuration rule 210: ensure all environment variables are documented and validated at startup.\n- Configuration rule 211: ensure all environment variables are documented and validated at startup.\n- Configuration rule 212: ensure all environment variables are documented and validated at startup.\n- Configuration rule 213: ensure all environment variables are documented and validated at startup.\n- Configuration rule 214: ensure all environment variables are documented and validated at startup.\n- Configuration rule 215: ensure all environment variables are documented and validated at startup.\n- Configuration rule 216: ensure all environment variables are documented and validated at startup.\n- Configuration rule 217: ensure all environment variables are documented and validated at startup.\n- Configuration rule 218: ensure all environment variables are documented and validated at startup.\n- Configuration rule 219: ensure all environment variables are documented and validated at startup.\n- Configuration rule 220: ensure all environment variables are documented and validated at startup.\n- Configuration rule 221: ensure all environment variables are documented and validated at startup.\n- Configuration rule 222: ensure all environment variables are documented and validated at startup.\n- Configuration rule 223: ensure all environment variables are documented and validated at startup.\n- Configuration rule 224: ensure all environment variables are documented and validated at startup.\n- Configuration rule 225: ensure all environment variables are documented and validated at startup.\n- Configuration rule 226: ensure all environment variables are documented and validated at startup.\n- Configuration rule 227: ensure all environment variables are documented and validated at startup.\n- Configuration rule 228: ensure all environment variables are documented and validated at startup.\n- Configuration rule 229: ensure all environment variables are documented and validated at startup.\n- Configuration rule 230: ensure all environment variables are documented and validated at startup.\n- Configuration rule 231: ensure all environment variables are documented and validated at startup.\n- Configuration rule 232: ensure all environment variables are documented and validated at startup.\n- Configuration rule 233: ensure all environment variables are documented and validated at startup.\n- Configuration rule 234: ensure all environment variables are documented and validated at startup.\n- Configuration rule 235: ensure all environment variables are documented and validated at startup.\n- Configuration rule 236: ensure all environment variables are documented and validated at startup.\n- Configuration rule 237: ensure all environment variables are documented and validated at startup.\n- Configuration rule 238: ensure all environment variables are documented and validated at startup.\n- Configuration rule 239: ensure all environment variables are documented and validated at startup.\n- Configuration rule 240: ensure all environment variables are documented and validated at startup.\n- Configuration rule 241: ensure all environment variables are documented and validated at startup.\n- Configuration rule 242: ensure all environment variables are documented and validated at startup.\n- Configuration rule 243: ensure all environment variables are documented and validated at startup.\n- Configuration rule 244: ensure all environment variables are documented and validated at startup.\n- Configuration rule 245: ensure all environment variables are documented and validated at startup.\n- Configuration rule 246: ensure all environment variables are documented and validated at startup.\n- Configuration rule 247: ensure all environment variables are documented and validated at startup.\n- Configuration rule 248: ensure all environment variables are documented and validated at startup.\n- Configuration rule 249: ensure all environment variables are documented and validated at startup.\n- Configuration rule 250: ensure all environment variables are documented and validated at startup.\n- Configuration rule 251: ensure all environment variables are documented and validated at startup.\n- Configuration rule 252: ensure all environment variables are documented and validated at startup.\n- Configuration rule 253: ensure all environment variables are documented and validated at startup.\n- Configuration rule 254: ensure all environment variables are documented and validated at startup.\n- Configuration rule 255: ensure all environment variables are documented and validated at startup.\n- Configuration rule 256: ensure all environment variables are documented and validated at startup.\n- Configuration rule 257: ensure all environment variables are documented and validated at startup.\n- Configuration rule 258: ensure all environment variables are documented and validated at startup.\n- Configuration rule 259: ensure all environment variables are documented and validated at startup.\n- Configuration rule 260: ensure all environment variables are documented and validated at startup.\n- Configuration rule 261: ensure all environment variables are documented and validated at startup.\n- Configuration rule 262: ensure all environment variables are documented and validated at startup.\n- Configuration rule 263: ensure all environment variables are documented and validated at startup.\n- Configuration rule 264: ensure all environment variables are documented and validated at startup.\n- Configuration rule 265: ensure all environment variables are documented and validated at startup.\n- Configuration rule 266: ensure all environment variables are documented and validated at startup.\n- Configuration rule 267: ensure all environment variables are documented and validated at startup.\n- Configuration rule 268: ensure all environment variables are documented and validated at startup.\n- Configuration rule 269: ensure all environment variables are documented and validated at startup.\n- Configuration rule 270: ensure all environment variables are documented and validated at startup.\n- Configuration rule 271: ensure all environment variables are documented and validated at startup.\n- Configuration rule 272: ensure all environment variables are documented and validated at startup.\n- Configuration rule 273: ensure all environment variables are documented and validated at startup.\n- Configuration rule 274: ensure all environment variables are documented and validated at startup.\n- Configuration rule 275: ensure all environment variables are documented and validated at startup.\n- Configuration rule 276: ensure all environment variables are documented and validated at startup.\n- Configuration rule 277: ensure all environment variables are documented and validated at startup.\n- Configuration rule 278: ensure all environment variables are documented and validated at startup.\n- Configuration rule 279: ensure all environment variables are documented and validated at startup.\n- Configuration rule 280: ensure all environment variables are documented and validated at startup.\n- Configuration rule 281: ensure all environment variables are documented and validated at startup.\n- Configuration rule 282: ensure all environment variables are documented and validated at startup.\n- Configuration rule 283: ensure all environment variables are documented and validated at startup.\n- Configuration rule 284: ensure all environment variables are documented and validated at startup.\n- Configuration rule 285: ensure all environment variables are documented and validated at startup.\n- Configuration rule 286: ensure all environment variables are documented and validated at startup.\n- Configuration rule 287: ensure all environment variables are documented and validated at startup.\n- Configuration rule 288: ensure all environment variables are documented and validated at startup.\n- Configuration rule 289: ensure all environment variables are documented and validated at startup.\n- Configuration rule 290: ensure all environment variables are documented and validated at startup.\n- Configuration rule 291: ensure all environment variables are documented and validated at startup.\n- Configuration rule 292: ensure all environment variables are documented and validated at startup.\n- Configuration rule 293: ensure all environment variables are documented and validated at startup.\n- Configuration rule 294: ensure all environment variables are documented and validated at startup.\n- Configuration rule 295: ensure all environment variables are documented and validated at startup.\n- Configuration rule 296: ensure all environment variables are documented and validated at startup.\n- Configuration rule 297: ensure all environment variables are documented and validated at startup.\n- Configuration rule 298: ensure all environment variables are documented and validated at startup.\n- Configuration rule 299: ensure all environment variables are documented and validated at startup.\n- Configuration rule 300: ensure all environment variables are documented and validated at startup.\n"
    },
    {
      "id": "AGM-004",
      "name": "Missing Project Context",
      "severity": "MEDIUM",
      "category": "agents-md",
      "evidence": {
        "source_type": "community",
        "source_urls": [
          "https://developers.openai.com/codex/guides/agents-md",
          "https://cursor.com/docs/rules"
        ],
        "verified_on": "2026-02-04",
        "applies_to": {},
        "normative_level": "BEST_PRACTICE",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "# Project\n\nThis is a web application for task management built with React and Node.js.\n\n## Build Commands\n\nRun npm install and npm build.",
      "bad_example": "# Build Commands\n\nRun npm install and npm build.\n\n## Testing\n\nUse npm test."
    },
    {
      "id": "AGM-005",
      "name": "Platform-Specific Features Without Guard",
      "severity": "MEDIUM",
      "category": "agents-md",
      "evidence": {
        "source_type": "community",
        "source_urls": [
          "https://developers.openai.com/codex/guides/agents-md",
          "https://cursor.com/docs/rules"
        ],
        "verified_on": "2026-02-04",
        "applies_to": {},
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "# Project\n\nThis project uses various tools.\n\n## Claude Code Specific\n\n- type: PreToolExecution\n  command: echo \"lint\"\n\ncontext: fork\nagent: security-reviewer",
      "bad_example": "# Project\n\nThis project uses hooks.\n\n- type: PreToolExecution\n  command: echo \"test\"\n\ncontext: fork\nagent: reviewer\nallowed-tools: Read Write"
    },
    {
      "id": "AGM-006",
      "name": "Nested AGENTS.md Hierarchy",
      "severity": "MEDIUM",
      "category": "agents-md",
      "evidence": {
        "source_type": "community",
        "source_urls": [
          "https://developers.openai.com/codex/guides/agents-md",
          "https://docs.cline.bot/prompting/cline-memory-bank#cline-memory-bank-custom-instructions-[copy-this]",
          "https://github.blog/changelog/2025-08-28-copilot-coding-agent-now-supports-agents-md-custom-instructions/"
        ],
        "verified_on": "2026-02-09",
        "applies_to": {},
        "normative_level": "BEST_PRACTICE",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "# Project\n\nSingle AGENTS.md at the project root with all instructions.\n\n## Commands\n\n- npm test",
      "bad_example": "# Root AGENTS.md\n\nProject instructions.\n\n# src/AGENTS.md (nested, separate file)\n\nComponent-specific instructions that create hierarchy ambiguity."
    },
    {
      "id": "AMP-001",
      "name": "Invalid Amp Check Frontmatter",
      "severity": "HIGH",
      "category": "amp-checks",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://ampcode.com/manual#code-review-checks"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "amp"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe"
      },
      "good_example": "---\nname: security-review\ndescription: Review security-sensitive changes\nseverity-default: high\ntools:\n  - rg\n---\n# Security Review\n\nReview auth, secrets, and shell execution paths.",
      "bad_example": "---\ndescription: Review security-sensitive changes\nunknownKey: true\n---\n# Security Review\n\nMissing required name field."
    },
    {
      "id": "AMP-002",
      "name": "Invalid Amp severity-default",
      "severity": "MEDIUM",
      "category": "amp-checks",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://ampcode.com/manual#code-review-checks"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "amp"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe"
      },
      "good_example": "---\nname: security-review\nseverity-default: high\n---\n# Security Review\n\nReview auth and secret handling.",
      "bad_example": "---\nname: security-review\nseverity-default: urgent\n---\n# Security Review\n\nInvalid severity-default value."
    },
    {
      "id": "AMP-003",
      "name": "Invalid AGENTS.md globs Frontmatter for Amp",
      "severity": "MEDIUM",
      "category": "amp-checks",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://ampcode.com/manual#settings"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "amp"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "---\nglobs:\n  - \"src/**/*.rs\"\n---\n# AGENTS\n\nProject instructions for Amp.",
      "bad_example": "---\nglobs: \"[broken\"\n---\n# AGENTS\n\nInvalid glob syntax."
    },
    {
      "id": "AMP-004",
      "name": "Invalid Amp Settings Configuration",
      "severity": "HIGH",
      "category": "amp-checks",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://ampcode.com/manual#settings"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "amp"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe"
      },
      "good_example": "{\n  \"model\": \"amp-default\",\n  \"notify\": true\n}",
      "bad_example": "{\n  \"model\": \"amp-default\",\n  \"unknownKey\": true\n}"
    },
    {
      "id": "AMP-SK-001",
      "name": "Amp Skill Uses Unsupported Field",
      "severity": "MEDIUM",
      "category": "amp-skills",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://ampcode.com/manual#agent-skills"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "amp"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe/unsafe"
      },
      "good_example": "---\nname: my-skill\ndescription: A useful development skill\n---\n# My Skill\n\nSkill instructions here.",
      "bad_example": "---\nname: my-skill\ndescription: A useful development skill\nmodel: opus\n---\n# My Skill\n\nSkill instructions here.\n\n(Note: AMP-SK-001 requires explicit Amp configuration context. The .agents/ directory is mapped to Codex by default.)"
    },
    {
      "id": "AS-001",
      "name": "Missing Frontmatter",
      "severity": "HIGH",
      "category": "agent-skills",
      "evidence": {
        "source_type": "spec",
        "source_urls": [
          "https://agentskills.io/specification"
        ],
        "verified_on": "2026-02-04",
        "applies_to": {
          "spec_revision": "1.0"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe"
      },
      "good_example": "---\nname: deploy-app\ndescription: Use when deploying the application to production\n---\nRun the deploy script with the correct environment variables.",
      "bad_example": "No frontmatter here.\nJust plain markdown content without YAML delimiters."
    },
    {
      "id": "AS-002",
      "name": "Missing Required Field: name",
      "severity": "HIGH",
      "category": "agent-skills",
      "evidence": {
        "source_type": "spec",
        "source_urls": [
          "https://agentskills.io/specification"
        ],
        "verified_on": "2026-02-04",
        "applies_to": {
          "spec_revision": "1.0"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe"
      },
      "good_example": "---\nname: lint-code\ndescription: Use when linting the codebase\n---\nRun eslint on all source files.",
      "bad_example": "---\ndescription: Use when linting the codebase\n---\nRun eslint on all source files."
    },
    {
      "id": "AS-003",
      "name": "Missing Required Field: description",
      "severity": "HIGH",
      "category": "agent-skills",
      "evidence": {
        "source_type": "spec",
        "source_urls": [
          "https://agentskills.io/specification"
        ],
        "verified_on": "2026-02-04",
        "applies_to": {
          "spec_revision": "1.0"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe"
      },
      "good_example": "---\nname: lint-code\ndescription: Use when linting the codebase\n---\nRun eslint on all source files.",
      "bad_example": "---\nname: lint-code\n---\nRun eslint on all source files."
    },
    {
      "id": "AS-004",
      "name": "Invalid Name Format",
      "severity": "HIGH",
      "category": "agent-skills",
      "evidence": {
        "source_type": "spec",
        "source_urls": [
          "https://agentskills.io/specification"
        ],
        "verified_on": "2026-02-04",
        "applies_to": {
          "spec_revision": "1.0"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe/unsafe"
      },
      "good_example": "---\nname: run-tests\ndescription: Use when running the test suite\n---\nExecute all unit tests.",
      "bad_example": "---\nname: Run_Tests!\ndescription: Use when running the test suite\n---\nExecute all unit tests."
    },
    {
      "id": "AS-005",
      "name": "Name Starts/Ends with Hyphen",
      "severity": "HIGH",
      "category": "agent-skills",
      "evidence": {
        "source_type": "spec",
        "source_urls": [
          "https://agentskills.io/specification"
        ],
        "verified_on": "2026-02-04",
        "applies_to": {
          "spec_revision": "1.0"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe"
      },
      "good_example": "---\nname: build-project\ndescription: Use when building the project\n---\nRun the build script.",
      "bad_example": "---\nname: -build-project-\ndescription: Use when building the project\n---\nRun the build script."
    },
    {
      "id": "AS-006",
      "name": "Consecutive Hyphens in Name",
      "severity": "HIGH",
      "category": "agent-skills",
      "evidence": {
        "source_type": "spec",
        "source_urls": [
          "https://agentskills.io/specification"
        ],
        "verified_on": "2026-02-04",
        "applies_to": {
          "spec_revision": "1.0"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe"
      },
      "good_example": "---\nname: format-code\ndescription: Use when formatting source code\n---\nRun prettier on all files.",
      "bad_example": "---\nname: format--code\ndescription: Use when formatting source code\n---\nRun prettier on all files."
    },
    {
      "id": "AS-008",
      "name": "Description Too Short",
      "severity": "HIGH",
      "category": "agent-skills",
      "evidence": {
        "source_type": "spec",
        "source_urls": [
          "https://agentskills.io/specification"
        ],
        "verified_on": "2026-02-04",
        "applies_to": {
          "spec_revision": "1.0"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "---\nname: check-deps\ndescription: Use when checking project dependencies for updates\n---\nRun npm outdated.",
      "bad_example": "---\nname: check-deps\ndescription: \"\"\n---\nRun npm outdated."
    },
    {
      "id": "AS-009",
      "name": "Description Contains Angle Brackets (Codex)",
      "severity": "HIGH",
      "category": "agent-skills",
      "evidence": {
        "source_type": "vendor_code",
        "source_urls": [
          "https://github.com/openai/codex/blob/main/codex-rs/skills/src/assets/samples/skill-creator/scripts/quick_validate.py"
        ],
        "verified_on": "2026-05-24",
        "applies_to": {
          "tool": "codex"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": false,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe"
      },
      "good_example": "---\nname: review-pr\ndescription: Use when reviewing a pull request for issues\n---\nCheck the PR for bugs.",
      "bad_example": "---\nname: review-pr\ndescription: Use when reviewing a <pull-request> for <issues>\n---\nCheck the PR for bugs."
    },
    {
      "id": "AS-011",
      "name": "Invalid Compatibility Length",
      "severity": "HIGH",
      "category": "agent-skills",
      "evidence": {
        "source_type": "spec",
        "source_urls": [
          "https://agentskills.io/specification"
        ],
        "verified_on": "2026-02-04",
        "applies_to": {
          "spec_revision": "1.0"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "---\nname: migrate-db\ndescription: Use when running database migrations\ncompatibility: Requires PostgreSQL 14+ and Node.js 18+\n---\nRun the migration scripts.",
      "bad_example": "---\nname: migrate-db\ndescription: Use when running database migrations\ncompatibility: \"\"\n---\nRun the migration scripts."
    },
    {
      "id": "AS-012",
      "name": "Content Exceeds 500 Lines",
      "severity": "MEDIUM",
      "category": "agent-skills",
      "evidence": {
        "source_type": "spec",
        "source_urls": [
          "https://agentskills.io/specification"
        ],
        "verified_on": "2026-05-24",
        "applies_to": {
          "spec_revision": "1.0"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "---\nname: setup-env\ndescription: Use when setting up the development environment\n---\nInstall dependencies and configure env vars.",
      "bad_example": "---\nname: setup-env\ndescription: Use when setting up the development environment\n---\nStep 1: Install Node.js\nStep 2: Install npm packages\nStep 3: Configure database\nStep 4: Set environment variables\nStep 5: Run migrations\nStep 6: Seed data\nStep 7: Start server\nStep 8: Verify health check\nStep 9: Run smoke tests\nStep 10: Done\n(imagine this continues for 500+ lines)"
    },
    {
      "id": "AS-013",
      "name": "File Reference Too Deep",
      "severity": "MEDIUM",
      "category": "agent-skills",
      "evidence": {
        "source_type": "spec",
        "source_urls": [
          "https://agentskills.io/specification"
        ],
        "verified_on": "2026-05-24",
        "applies_to": {
          "spec_revision": "1.0"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "---\nname: read-config\ndescription: Use when reading project configuration\n---\nSee references/config.md for details.",
      "bad_example": "---\nname: read-config\ndescription: Use when reading project configuration\n---\nSee references/deep/nested/config.md for details."
    },
    {
      "id": "AS-015",
      "name": "Upload Size Exceeds 8MB",
      "severity": "HIGH",
      "category": "agent-skills",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://platform.claude.com/docs"
        ],
        "verified_on": "2026-02-04",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "---\nname: small-skill\ndescription: Use when running a lightweight task\n---\nThis skill directory is under 8MB total.",
      "bad_example": "---\nname: huge-skill\ndescription: Use when running a task with many large assets\n---\nThis skill bundles 10MB of binary data in its directory."
    },
    {
      "id": "AS-016",
      "name": "Skill Parse Error",
      "severity": "HIGH",
      "category": "agent-skills",
      "evidence": {
        "source_type": "spec",
        "source_urls": [
          "https://agentskills.io/specification"
        ],
        "verified_on": "2026-02-04",
        "applies_to": {
          "spec_revision": "1.0"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "---\nname: valid-yaml\ndescription: Use when demonstrating valid YAML frontmatter\n---\nBody content here.",
      "bad_example": "---\nname: broken-yaml\ndescription: [unclosed bracket\n---\nBody content here."
    },
    {
      "id": "AS-017",
      "name": "Name Must Match Parent Directory",
      "severity": "HIGH",
      "category": "agent-skills",
      "evidence": {
        "source_type": "spec",
        "source_urls": [
          "https://agentskills.io/specification"
        ],
        "verified_on": "2026-02-14",
        "applies_to": {
          "spec_revision": "1.0"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "---\nname: code-review\ndescription: Use when reviewing pull requests\n---\nReview changed files and report findings.",
      "bad_example": "---\nname: deploy-helper\ndescription: Use when validating deployment checks\n---\nThis file is stored in code-review/SKILL.md."
    },
    {
      "id": "CC-AG-001",
      "name": "Missing Name Field",
      "severity": "HIGH",
      "category": "claude-agents",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/sub-agents"
        ],
        "verified_on": "2026-02-04",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe"
      },
      "good_example": "---\nname: code-reviewer\ndescription: Reviews pull requests for quality\n---\nReview code changes and provide feedback.",
      "bad_example": "---\ndescription: Reviews pull requests for quality\n---\nReview code changes and provide feedback."
    },
    {
      "id": "CC-AG-002",
      "name": "Missing Description Field",
      "severity": "HIGH",
      "category": "claude-agents",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/sub-agents"
        ],
        "verified_on": "2026-02-04",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe"
      },
      "good_example": "---\nname: code-reviewer\ndescription: Reviews pull requests for quality\n---\nReview code changes and provide feedback.",
      "bad_example": "---\nname: code-reviewer\n---\nReview code changes and provide feedback."
    },
    {
      "id": "CC-AG-003",
      "name": "Invalid Model Value",
      "severity": "HIGH",
      "category": "claude-agents",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/sub-agents"
        ],
        "verified_on": "2026-02-04",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "unsafe"
      },
      "good_example": "---\nname: code-reviewer\ndescription: Reviews code\nmodel: sonnet\n---\nReview code changes.",
      "bad_example": "---\nname: code-reviewer\ndescription: Reviews code\nmodel: gpt-4\n---\nReview code changes."
    },
    {
      "id": "CC-AG-004",
      "name": "Invalid Permission Mode",
      "severity": "HIGH",
      "category": "claude-agents",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/sub-agents"
        ],
        "verified_on": "2026-02-04",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "unsafe"
      },
      "good_example": "---\nname: code-reviewer\ndescription: Reviews code\npermissionMode: acceptEdits\n---\nReview code changes.",
      "bad_example": "---\nname: code-reviewer\ndescription: Reviews code\npermissionMode: yolo\n---\nReview code changes."
    },
    {
      "id": "CC-AG-005",
      "name": "Referenced Skill Not Found",
      "severity": "HIGH",
      "category": "claude-agents",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/sub-agents"
        ],
        "verified_on": "2026-02-04",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "---\nname: code-reviewer\ndescription: Reviews code\nskills:\n  - code-review\n---\nReview code changes.",
      "bad_example": "---\nname: code-reviewer\ndescription: Reviews code\nskills:\n  - nonexistent-skill\n---\nReview code changes."
    },
    {
      "id": "CC-AG-006",
      "name": "Tool/Disallowed Conflict",
      "severity": "HIGH",
      "category": "claude-agents",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/sub-agents"
        ],
        "verified_on": "2026-02-04",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "---\nname: safe-agent\ndescription: Agent with separate tool lists\ntools:\n  - Read\n  - Grep\ndisallowedTools:\n  - Bash\n---\nAgent instructions.",
      "bad_example": "---\nname: conflict-agent\ndescription: Agent with conflicting tool lists\ntools:\n  - Read\n  - Bash\ndisallowedTools:\n  - Bash\n---\nAgent instructions."
    },
    {
      "id": "CC-AG-007",
      "name": "Agent Parse Error",
      "severity": "HIGH",
      "category": "claude-agents",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/sub-agents"
        ],
        "verified_on": "2026-02-04",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "---\nname: my-agent\ndescription: A working agent\n---\nAgent instructions here.",
      "bad_example": "name: my-agent\ndescription: Missing the --- delimiters\n\nAgent instructions here."
    },
    {
      "id": "CC-AG-008",
      "name": "Invalid Memory Scope",
      "severity": "HIGH",
      "category": "claude-agents",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/sub-agents"
        ],
        "verified_on": "2026-02-07",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "unsafe"
      },
      "good_example": "---\nname: my-agent\ndescription: Agent with valid memory\nmemory: project\n---\nAgent instructions.",
      "bad_example": "---\nname: my-agent\ndescription: Agent with invalid memory\nmemory: global\n---\nAgent instructions."
    },
    {
      "id": "CC-AG-009",
      "name": "Invalid Tool Name in Tools List",
      "severity": "HIGH",
      "category": "claude-agents",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/sub-agents"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "---\nname: my-agent\ndescription: Agent with valid tools\ntools:\n  - Read\n  - Write\n  - Bash\n---\nAgent instructions.",
      "bad_example": "---\nname: my-agent\ndescription: Agent with unknown tool\ntools:\n  - Read\n  - MakeFile\n---\nAgent instructions."
    },
    {
      "id": "CC-AG-010",
      "name": "Invalid Tool Name in DisallowedTools",
      "severity": "HIGH",
      "category": "claude-agents",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/sub-agents"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "---\nname: my-agent\ndescription: Agent with valid disallowed tools\ndisallowedTools:\n  - Bash\n  - WebFetch\n---\nAgent instructions.",
      "bad_example": "---\nname: my-agent\ndescription: Agent with unknown disallowed tool\ndisallowedTools:\n  - Bash\n  - RunCode\n---\nAgent instructions."
    },
    {
      "id": "CC-AG-011",
      "name": "Invalid Hooks in Agent Frontmatter",
      "severity": "HIGH",
      "category": "claude-agents",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/sub-agents"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "---\nname: my-agent\ndescription: Agent with valid hooks\nhooks:\n  PreToolUse:\n    - matcher: Bash\n      hooks:\n        - type: command\n          command: echo ok\n---\nAgent instructions.",
      "bad_example": "---\nname: my-agent\ndescription: Agent with invalid hooks\nhooks:\n  InvalidEvent:\n    - matcher: Bash\n      hooks:\n        - type: command\n          command: echo ok\n---\nAgent instructions."
    },
    {
      "id": "CC-AG-012",
      "name": "Bypass Permissions Warning",
      "severity": "HIGH",
      "category": "claude-agents",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/sub-agents"
        ],
        "verified_on": "2026-02-07",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "unsafe"
      },
      "good_example": "---\nname: my-agent\ndescription: Agent with safe permissions\npermissionMode: default\n---\nAgent instructions.",
      "bad_example": "---\nname: my-agent\ndescription: Agent with dangerous permissions\npermissionMode: bypassPermissions\n---\nAgent instructions."
    },
    {
      "id": "CC-AG-013",
      "name": "Invalid Skill Name Format",
      "severity": "MEDIUM",
      "category": "claude-agents",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/sub-agents"
        ],
        "verified_on": "2026-02-07",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "unsafe"
      },
      "good_example": "---\nname: my-agent\ndescription: Agent with valid skill names\nskills:\n  - code-review\n  - deploy-prod\n---\nAgent instructions.",
      "bad_example": "---\nname: my-agent\ndescription: Agent with invalid skill name format\nskills:\n  - Code_Review\n  - --bad-name\n---\nAgent instructions."
    },
    {
      "id": "CC-AG-014",
      "name": "Invalid Effort Value",
      "severity": "MEDIUM",
      "category": "claude-agents",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/sub-agents"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": false,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "unsafe"
      },
      "good_example": "---\nname: my-agent\neffort: high\n---\nAgent instructions.",
      "bad_example": "---\nname: my-agent\neffort: maximum\n---\nAgent instructions."
    },
    {
      "id": "CC-AG-015",
      "name": "Invalid Isolation Value",
      "severity": "MEDIUM",
      "category": "claude-agents",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/sub-agents"
        ],
        "verified_on": "2026-03-28",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": false,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "unsafe"
      },
      "good_example": "---\nname: my-agent\nisolation: full\n---\nAgent instructions.",
      "bad_example": "---\nname: my-agent\nisolation: partial\n---\nAgent instructions."
    },
    {
      "id": "CC-AG-017",
      "name": "Invalid MaxTurns Value",
      "severity": "MEDIUM",
      "category": "claude-agents",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/sub-agents"
        ],
        "verified_on": "2026-03-28",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": false,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "---\nname: my-agent\nmax-turns: 10\n---\nAgent instructions.",
      "bad_example": "---\nname: my-agent\nmax-turns: \"ten\"\n---\nAgent instructions."
    },
    {
      "id": "CC-AG-019",
      "name": "Unknown Agent Frontmatter Field",
      "severity": "LOW",
      "category": "claude-agents",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/sub-agents"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": false,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "unsafe"
      },
      "good_example": "---\nname: my-agent\ndescription: A helpful agent\n---\nAgent instructions.",
      "bad_example": "---\nname: my-agent\npriority: high\n---\nAgent instructions."
    },
    {
      "id": "CC-HK-001",
      "name": "Invalid Hook Event",
      "severity": "HIGH",
      "category": "claude-hooks",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/hooks"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe/unsafe"
      },
      "good_example": "{\n  \"hooks\": {\n    \"PreToolUse\": [\n      {\n        \"matcher\": \"Bash\",\n        \"hooks\": [\n          { \"type\": \"command\", \"command\": \"echo pre-tool\", \"timeout\": 30 }\n        ]\n      }\n    ]\n  }\n}",
      "bad_example": "{\n  \"hooks\": {\n    \"OnBeforeTool\": [\n      {\n        \"matcher\": \"Bash\",\n        \"hooks\": [\n          { \"type\": \"command\", \"command\": \"echo hello\", \"timeout\": 30 }\n        ]\n      }\n    ]\n  }\n}"
    },
    {
      "id": "CC-HK-002",
      "name": "Prompt Hook on Wrong Event",
      "severity": "HIGH",
      "category": "claude-hooks",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/hooks"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"hooks\": {\n    \"Stop\": [\n      {\n        \"hooks\": [\n          { \"type\": \"prompt\", \"prompt\": \"Summarize the session\", \"timeout\": 30 }\n        ]\n      }\n    ]\n  }\n}",
      "bad_example": "{\n  \"hooks\": {\n    \"SessionStart\": [\n      {\n        \"hooks\": [\n          { \"type\": \"prompt\", \"prompt\": \"Check session start\", \"timeout\": 30 }\n        ]\n      }\n    ]\n  }\n}"
    },
    {
      "id": "CC-HK-003",
      "name": "Matcher Hint for Tool Events",
      "severity": "LOW",
      "category": "claude-hooks",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/hooks"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "BEST_PRACTICE",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"hooks\": {\n    \"PreToolUse\": [\n      {\n        \"matcher\": \"Bash\",\n        \"hooks\": [\n          { \"type\": \"command\", \"command\": \"echo ok\", \"timeout\": 30 }\n        ]\n      }\n    ]\n  }\n}",
      "bad_example": "{\n  \"hooks\": {\n    \"PreToolUse\": [\n      {\n        \"hooks\": [\n          { \"type\": \"command\", \"command\": \"echo ok\", \"timeout\": 30 }\n        ]\n      }\n    ]\n  }\n}"
    },
    {
      "id": "CC-HK-004",
      "name": "Matcher on Non-Tool Event",
      "severity": "HIGH",
      "category": "claude-hooks",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/hooks"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe"
      },
      "good_example": "{\n  \"hooks\": {\n    \"Notification\": [\n      {\n        \"hooks\": [\n          { \"type\": \"command\", \"command\": \"echo notified\", \"timeout\": 30 }\n        ]\n      }\n    ]\n  }\n}",
      "bad_example": "{\n  \"hooks\": {\n    \"Notification\": [\n      {\n        \"matcher\": \"Bash\",\n        \"hooks\": [\n          { \"type\": \"command\", \"command\": \"echo notified\", \"timeout\": 30 }\n        ]\n      }\n    ]\n  }\n}"
    },
    {
      "id": "CC-HK-005",
      "name": "Missing Type Field",
      "severity": "HIGH",
      "category": "claude-hooks",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/hooks"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe"
      },
      "good_example": "{\n  \"hooks\": {\n    \"Stop\": [\n      {\n        \"hooks\": [\n          { \"type\": \"command\", \"command\": \"echo done\", \"timeout\": 30 }\n        ]\n      }\n    ]\n  }\n}",
      "bad_example": "{\n  \"hooks\": {\n    \"Stop\": [\n      {\n        \"hooks\": [\n          { \"command\": \"echo missing type field\" }\n        ]\n      }\n    ]\n  }\n}"
    },
    {
      "id": "CC-HK-006",
      "name": "Missing Command Field",
      "severity": "HIGH",
      "category": "claude-hooks",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/hooks"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"hooks\": {\n    \"Stop\": [\n      {\n        \"hooks\": [\n          { \"type\": \"command\", \"command\": \"echo done\", \"timeout\": 30 }\n        ]\n      }\n    ]\n  }\n}",
      "bad_example": "{\n  \"hooks\": {\n    \"Stop\": [\n      {\n        \"hooks\": [\n          { \"type\": \"command\", \"timeout\": 30 }\n        ]\n      }\n    ]\n  }\n}"
    },
    {
      "id": "CC-HK-007",
      "name": "Missing Prompt Field",
      "severity": "HIGH",
      "category": "claude-hooks",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/hooks"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"hooks\": {\n    \"Stop\": [\n      {\n        \"hooks\": [\n          { \"type\": \"prompt\", \"prompt\": \"Summarize what was done\", \"timeout\": 30 }\n        ]\n      }\n    ]\n  }\n}",
      "bad_example": "{\n  \"hooks\": {\n    \"Stop\": [\n      {\n        \"hooks\": [\n          { \"type\": \"prompt\", \"timeout\": 30 }\n        ]\n      }\n    ]\n  }\n}"
    },
    {
      "id": "CC-HK-008",
      "name": "Script File Not Found",
      "severity": "HIGH",
      "category": "claude-hooks",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/hooks"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"hooks\": {\n    \"PreToolUse\": [\n      {\n        \"matcher\": \"Bash\",\n        \"hooks\": [\n          { \"type\": \"command\", \"command\": \"echo inline check\", \"timeout\": 30 }\n        ]\n      }\n    ]\n  }\n}",
      "bad_example": "{\n  \"hooks\": {\n    \"PreToolUse\": [\n      {\n        \"matcher\": \"Bash\",\n        \"hooks\": [\n          { \"type\": \"command\", \"command\": \"./scripts/nonexistent-hook.sh\", \"timeout\": 30 }\n        ]\n      }\n    ]\n  }\n}"
    },
    {
      "id": "CC-HK-009",
      "name": "Dangerous Command Pattern",
      "severity": "HIGH",
      "category": "claude-hooks",
      "evidence": {
        "source_type": "community",
        "source_urls": [
          "https://github.com/anthropics/claude-code/tree/main/.claude/commands"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"hooks\": {\n    \"PreToolUse\": [\n      {\n        \"matcher\": \"Bash\",\n        \"hooks\": [\n          { \"type\": \"command\", \"command\": \"echo $TOOL_INPUT | jq .command\", \"timeout\": 30 }\n        ]\n      }\n    ]\n  }\n}",
      "bad_example": "{\n  \"hooks\": {\n    \"PreToolUse\": [\n      {\n        \"matcher\": \"Bash\",\n        \"hooks\": [\n          { \"type\": \"command\", \"command\": \"rm -rf /\", \"timeout\": 30 }\n        ]\n      }\n    ]\n  }\n}"
    },
    {
      "id": "CC-HK-010",
      "name": "Timeout Policy",
      "severity": "MEDIUM",
      "category": "claude-hooks",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/hooks"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe"
      },
      "good_example": "{\n  \"hooks\": {\n    \"PreToolUse\": [\n      {\n        \"matcher\": \"Bash\",\n        \"hooks\": [\n          { \"type\": \"command\", \"command\": \"echo ok\", \"timeout\": 30 }\n        ]\n      }\n    ]\n  }\n}",
      "bad_example": "{\n  \"hooks\": {\n    \"PreToolUse\": [\n      {\n        \"matcher\": \"Bash\",\n        \"hooks\": [\n          { \"type\": \"command\", \"command\": \"echo ok\" }\n        ]\n      }\n    ]\n  }\n}"
    },
    {
      "id": "CC-HK-011",
      "name": "Invalid Timeout Value",
      "severity": "HIGH",
      "category": "claude-hooks",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/hooks"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "unsafe"
      },
      "good_example": "{\n  \"hooks\": {\n    \"PreToolUse\": [\n      {\n        \"matcher\": \"Bash\",\n        \"hooks\": [\n          { \"type\": \"command\", \"command\": \"echo ok\", \"timeout\": 30 }\n        ]\n      }\n    ]\n  }\n}",
      "bad_example": "{\n  \"hooks\": {\n    \"PreToolUse\": [\n      {\n        \"matcher\": \"Bash\",\n        \"hooks\": [\n          { \"type\": \"command\", \"command\": \"echo ok\", \"timeout\": -5 }\n        ]\n      }\n    ]\n  }\n}"
    },
    {
      "id": "CC-HK-012",
      "name": "Hooks Parse Error",
      "severity": "HIGH",
      "category": "claude-hooks",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/hooks"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"hooks\": {\n    \"Stop\": [\n      {\n        \"hooks\": [\n          { \"type\": \"command\", \"command\": \"echo bye\", \"timeout\": 30 }\n        ]\n      }\n    ]\n  }\n}",
      "bad_example": "{\n  \"hooks\": {\n    \"Stop\": [\n      {\n        hooks: [\n          { type: command }\n        ]\n      }\n    ]\n  }\n}"
    },
    {
      "id": "CC-HK-013",
      "name": "Async on Non-Command Hook",
      "severity": "HIGH",
      "category": "claude-hooks",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/hooks"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe"
      },
      "good_example": "{\n  \"hooks\": {\n    \"PreToolUse\": [\n      {\n        \"matcher\": \"Bash\",\n        \"hooks\": [\n          { \"type\": \"command\", \"command\": \"echo ok\", \"timeout\": 30 }\n        ]\n      }\n    ]\n  }\n}",
      "bad_example": "{\n  \"hooks\": {\n    \"Stop\": [\n      {\n        \"hooks\": [\n          { \"type\": \"prompt\", \"prompt\": \"Summarize\", \"async\": true, \"timeout\": 30 }\n        ]\n      }\n    ]\n  }\n}"
    },
    {
      "id": "CC-HK-014",
      "name": "Once Outside Skill/Agent Frontmatter",
      "severity": "MEDIUM",
      "category": "claude-hooks",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/hooks"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe"
      },
      "good_example": "{\n  \"hooks\": {\n    \"PreToolUse\": [\n      {\n        \"matcher\": \"Bash\",\n        \"hooks\": [\n          { \"type\": \"command\", \"command\": \"echo ok\", \"timeout\": 30 }\n        ]\n      }\n    ]\n  }\n}",
      "bad_example": "{\n  \"hooks\": {\n    \"PreToolUse\": [\n      {\n        \"matcher\": \"Bash\",\n        \"hooks\": [\n          { \"type\": \"command\", \"command\": \"echo ok\", \"once\": true, \"timeout\": 30 }\n        ]\n      }\n    ]\n  }\n}"
    },
    {
      "id": "CC-HK-015",
      "name": "Model on Command Hook",
      "severity": "MEDIUM",
      "category": "claude-hooks",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/hooks"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe"
      },
      "good_example": "{\n  \"hooks\": {\n    \"Stop\": [\n      {\n        \"hooks\": [\n          { \"type\": \"prompt\", \"prompt\": \"Summarize\", \"model\": \"haiku\", \"timeout\": 30 }\n        ]\n      }\n    ]\n  }\n}",
      "bad_example": "{\n  \"hooks\": {\n    \"PreToolUse\": [\n      {\n        \"matcher\": \"Bash\",\n        \"hooks\": [\n          { \"type\": \"command\", \"command\": \"echo ok\", \"model\": \"haiku\", \"timeout\": 30 }\n        ]\n      }\n    ]\n  }\n}"
    },
    {
      "id": "CC-HK-016",
      "name": "Validate Hook Type Agent",
      "severity": "HIGH",
      "category": "claude-hooks",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/hooks"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "unsafe"
      },
      "good_example": "{\n  \"hooks\": {\n    \"Stop\": [\n      {\n        \"hooks\": [\n          { \"type\": \"command\", \"command\": \"echo done\", \"timeout\": 30 }\n        ]\n      }\n    ]\n  }\n}",
      "bad_example": "{\n  \"hooks\": {\n    \"Stop\": [\n      {\n        \"hooks\": [\n          { \"type\": \"webhook\", \"url\": \"https://example.com\", \"timeout\": 30 }\n        ]\n      }\n    ]\n  }\n}"
    },
    {
      "id": "CC-HK-017",
      "name": "Prompt/Agent Hook Missing $ARGUMENTS",
      "severity": "MEDIUM",
      "category": "claude-hooks",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/hooks"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe"
      },
      "good_example": "{\n  \"hooks\": {\n    \"Stop\": [\n      {\n        \"hooks\": [\n          { \"type\": \"prompt\", \"prompt\": \"Summarize: $ARGUMENTS\", \"timeout\": 30 }\n        ]\n      }\n    ]\n  }\n}",
      "bad_example": "{\n  \"hooks\": {\n    \"Stop\": [\n      {\n        \"hooks\": [\n          { \"type\": \"prompt\", \"prompt\": \"Summarize what was done\", \"timeout\": 30 }\n        ]\n      }\n    ]\n  }\n}"
    },
    {
      "id": "CC-HK-018",
      "name": "Matcher on UserPromptSubmit/Stop",
      "severity": "LOW",
      "category": "claude-hooks",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/hooks"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "BEST_PRACTICE",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe"
      },
      "good_example": "{\n  \"hooks\": {\n    \"UserPromptSubmit\": [\n      {\n        \"hooks\": [\n          { \"type\": \"command\", \"command\": \"echo submit\", \"timeout\": 30 }\n        ]\n      }\n    ]\n  }\n}",
      "bad_example": "{\n  \"hooks\": {\n    \"UserPromptSubmit\": [\n      {\n        \"matcher\": \"Bash\",\n        \"hooks\": [\n          { \"type\": \"command\", \"command\": \"echo submit\", \"timeout\": 30 }\n        ]\n      }\n    ]\n  }\n}"
    },
    {
      "id": "CC-HK-019",
      "name": "Deprecated Setup Event",
      "severity": "MEDIUM",
      "category": "claude-hooks",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/hooks"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "claude-code",
          "file_types": [
            "settings-json",
            "hooks-json"
          ]
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "unsafe"
      },
      "good_example": "{\n  \"hooks\": {\n    \"SessionStart\": [\n      {\n        \"hooks\": [\n          { \"type\": \"command\", \"command\": \"echo start\", \"timeout\": 30 }\n        ]\n      }\n    ]\n  }\n}",
      "bad_example": "{\n  \"hooks\": {\n    \"Setup\": [\n      {\n        \"hooks\": [\n          { \"type\": \"command\", \"command\": \"echo start\", \"timeout\": 30 }\n        ]\n      }\n    ]\n  }\n}"
    },
    {
      "id": "CC-HK-020",
      "name": "HTTP Hook Missing URL",
      "severity": "HIGH",
      "category": "claude-hooks",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/hooks"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "claude-code",
          "file_types": [
            "settings-json",
            "hooks-json"
          ]
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": false,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{ \"type\": \"http\", \"url\": \"https://example.com/hook\", \"timeout\": 30 }",
      "bad_example": "{ \"type\": \"http\", \"timeout\": 30 }"
    },
    {
      "id": "CC-HK-021",
      "name": "Invalid If Field",
      "severity": "MEDIUM",
      "category": "claude-hooks",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/hooks"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "claude-code",
          "file_types": [
            "settings-json",
            "hooks-json"
          ]
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": false,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{ \"type\": \"command\", \"command\": \"npm test\", \"if\": \"tool_name == 'Bash'\" }",
      "bad_example": "{ \"type\": \"command\", \"command\": \"npm test\", \"if\": \"\" }"
    },
    {
      "id": "CC-HK-022",
      "name": "Invalid Shell Value",
      "severity": "MEDIUM",
      "category": "claude-hooks",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/hooks"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "claude-code",
          "file_types": [
            "settings-json",
            "hooks-json"
          ]
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": false,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "unsafe"
      },
      "good_example": "{ \"type\": \"command\", \"command\": \"echo hi\", \"shell\": \"bash\" }",
      "bad_example": "{ \"type\": \"command\", \"command\": \"echo hi\", \"shell\": \"zsh\" }"
    },
    {
      "id": "CC-HK-023",
      "name": "Once Field Not Boolean",
      "severity": "LOW",
      "category": "claude-hooks",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/hooks"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "claude-code",
          "file_types": [
            "settings-json",
            "hooks-json"
          ]
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": false,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "unsafe"
      },
      "good_example": "{ \"type\": \"command\", \"command\": \"echo hi\", \"once\": true }",
      "bad_example": "{ \"type\": \"command\", \"command\": \"echo hi\", \"once\": \"yes\" }"
    },
    {
      "id": "CC-HK-024",
      "name": "Headers Missing AllowedEnvVars",
      "severity": "MEDIUM",
      "category": "claude-hooks",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/hooks"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "claude-code",
          "file_types": [
            "settings-json",
            "hooks-json"
          ]
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": false,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe"
      },
      "good_example": "{ \"type\": \"http\", \"url\": \"https://ex.com\", \"headers\": { \"Authorization\": \"$TOKEN\" }, \"allowedEnvVars\": [\"TOKEN\"] }",
      "bad_example": "{ \"type\": \"http\", \"url\": \"https://ex.com\", \"headers\": { \"Authorization\": \"$TOKEN\" } }"
    },
    {
      "id": "CC-HK-025",
      "name": "Invalid Matcher Value",
      "severity": "LOW",
      "category": "claude-hooks",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/hooks"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "claude-code",
          "file_types": [
            "settings-json",
            "hooks-json"
          ]
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": false,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "unsafe"
      },
      "good_example": "{ \"matcher\": \"Bash\", \"hooks\": [{ \"type\": \"command\", \"command\": \"echo ok\" }] }",
      "bad_example": "{ \"matcher\": 123, \"hooks\": [{ \"type\": \"command\", \"command\": \"echo ok\" }] }"
    },
    {
      "id": "CC-HK-026",
      "name": "MCP Tool Hook Missing Server",
      "severity": "HIGH",
      "category": "claude-hooks",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/hooks"
        ],
        "verified_on": "2026-04-26",
        "applies_to": {
          "tool": "claude-code",
          "file_types": [
            "settings-json",
            "hooks-json"
          ]
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{ \"type\": \"mcp_tool\", \"server\": \"my_server\", \"tool\": \"security_scan\" }",
      "bad_example": "{ \"type\": \"mcp_tool\", \"tool\": \"security_scan\" }"
    },
    {
      "id": "CC-HK-027",
      "name": "MCP Tool Hook Missing Tool",
      "severity": "HIGH",
      "category": "claude-hooks",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/hooks"
        ],
        "verified_on": "2026-04-26",
        "applies_to": {
          "tool": "claude-code",
          "file_types": [
            "settings-json",
            "hooks-json"
          ]
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{ \"type\": \"mcp_tool\", \"server\": \"my_server\", \"tool\": \"security_scan\" }",
      "bad_example": "{ \"type\": \"mcp_tool\", \"server\": \"my_server\" }"
    },
    {
      "id": "CC-MEM-001",
      "name": "Invalid Import Path",
      "severity": "HIGH",
      "category": "claude-memory",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/memory"
        ],
        "verified_on": "2026-02-04",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "# Project Memory\n\nAlways run tests before committing.\nFollow the coding standards in the docs/ directory.",
      "bad_example": "# Project Memory\n\nSee @docs/nonexistent-guide.md for the coding standards.\n\nAlways run tests before committing."
    },
    {
      "id": "CC-MEM-002",
      "name": "Circular Import",
      "severity": "HIGH",
      "category": "claude-memory",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/memory"
        ],
        "verified_on": "2026-02-04",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "# Project Memory\n\n@import ./docs/style.md\n@import ./docs/testing.md\n\nFollow these standards.",
      "bad_example": "# Project Memory\n\n@import ./CLAUDE.md\n\nThis file imports itself, creating a circular dependency."
    },
    {
      "id": "CC-MEM-003",
      "name": "Import Depth Exceeds 5",
      "severity": "HIGH",
      "category": "claude-memory",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/memory"
        ],
        "verified_on": "2026-02-04",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "# Project Memory\n\n@import ./docs/guidelines.md\n\nKeep import chains shallow.",
      "bad_example": "# Project Memory\n\n@import ./level1.md\n\nThis starts a chain: level1 -> level2 -> level3 -> level4 -> level5 -> level6 (exceeds depth 5)."
    },
    {
      "id": "CC-MEM-004",
      "name": "Invalid Command Reference",
      "severity": "MEDIUM",
      "category": "claude-memory",
      "evidence": {
        "source_type": "community",
        "source_urls": [
          "https://github.com/anthropics/claude-code/tree/main/.claude/commands"
        ],
        "verified_on": "2026-02-09",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "# Commands\n\nRun tests with `npm run test`\nBuild with `npm run build`\n\n(Valid when package.json has test and build scripts)",
      "bad_example": "# Commands\n\nRun tests with `npm run nonexistent`\n\n(Requires package.json with scripts section in the same directory for this rule to trigger)"
    },
    {
      "id": "CC-MEM-005",
      "name": "Generic Instruction",
      "severity": "HIGH",
      "category": "claude-memory",
      "evidence": {
        "source_type": "community",
        "source_urls": [
          "https://github.com/anthropics/claude-code/tree/main/.claude/commands",
          "https://arxiv.org/abs/2201.11903"
        ],
        "verified_on": "2026-02-09",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe"
      },
      "good_example": "# Project Rules\n\nAlways use TypeScript strict mode.\nRun `cargo test` before committing.",
      "bad_example": "Be helpful and accurate when responding.\nAlways provide the best possible answer."
    },
    {
      "id": "CC-MEM-006",
      "name": "Negative Without Positive",
      "severity": "HIGH",
      "category": "claude-memory",
      "evidence": {
        "source_type": "paper",
        "source_urls": [
          "https://arxiv.org/abs/2201.11903"
        ],
        "verified_on": "2026-02-04",
        "applies_to": {},
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "# Rules\n\nNever use var in JavaScript, instead prefer const or let.",
      "bad_example": "# Rules\n\nNever use var in JavaScript."
    },
    {
      "id": "CC-MEM-007",
      "name": "Weak Constraint Language",
      "severity": "HIGH",
      "category": "claude-memory",
      "evidence": {
        "source_type": "paper",
        "source_urls": [
          "https://arxiv.org/abs/2201.11903"
        ],
        "verified_on": "2026-02-04",
        "applies_to": {},
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe/unsafe"
      },
      "good_example": "# Critical Rules\n\nYou must follow the coding style guide.",
      "bad_example": "# Critical Rules\n\nYou should follow the coding style guide."
    },
    {
      "id": "CC-MEM-008",
      "name": "Critical Content in Middle",
      "severity": "HIGH",
      "category": "claude-memory",
      "evidence": {
        "source_type": "paper",
        "source_urls": [
          "https://aclanthology.org/2024.tacl-1.9/"
        ],
        "verified_on": "2026-02-04",
        "applies_to": {},
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "# Critical Rules\n\nIMPORTANT: Always run tests before committing.\n\n## Setup\n\nInstall dependencies with npm install.\n\n## Architecture\n\nThe project uses a monorepo structure.\n\n## Testing\n\nRun unit tests.\n\n## Deployment\n\nDeploy to staging.\n\n## Monitoring\n\nCheck dashboards.\n\n## Cleanup\n\nRemove temp files.",
      "bad_example": "## Setup\n\nInstall dependencies with npm install.\n\n## Architecture\n\nThe project uses a monorepo structure.\n\n## Testing\n\nRun unit tests with npm test.\n\nIMPORTANT: Always run tests before committing.\n\n## Deployment\n\nDeploy to staging first.\n\n## Monitoring\n\nCheck dashboards after deploy.\n\n## Cleanup\n\nRemove temp files after build."
    },
    {
      "id": "CC-MEM-009",
      "name": "Token Count Exceeded",
      "severity": "MEDIUM",
      "category": "claude-memory",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/memory"
        ],
        "verified_on": "2026-02-04",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "# Project Rules\n\nUse TypeScript strict mode.\nRun tests before committing.\nFollow the style guide.",
      "bad_example": "# Project Rules\n- Follow coding standard rule 1: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 2: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 3: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 4: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 5: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 6: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 7: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 8: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 9: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 10: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 11: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 12: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 13: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 14: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 15: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 16: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 17: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 18: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 19: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 20: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 21: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 22: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 23: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 24: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 25: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 26: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 27: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 28: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 29: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 30: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 31: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 32: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 33: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 34: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 35: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 36: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 37: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 38: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 39: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 40: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 41: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 42: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 43: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 44: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 45: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 46: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 47: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 48: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 49: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 50: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 51: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 52: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 53: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 54: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 55: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 56: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 57: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 58: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 59: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 60: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 61: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 62: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 63: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 64: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 65: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 66: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 67: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 68: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 69: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 70: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 71: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 72: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 73: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 74: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 75: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 76: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 77: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 78: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 79: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 80: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 81: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 82: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 83: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 84: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 85: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 86: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 87: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 88: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 89: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 90: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 91: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 92: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 93: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 94: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 95: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 96: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 97: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 98: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 99: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 100: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 101: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 102: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 103: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 104: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 105: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 106: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 107: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 108: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 109: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 110: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 111: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 112: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 113: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 114: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 115: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 116: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 117: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 118: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 119: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 120: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 121: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 122: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 123: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 124: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 125: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 126: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 127: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 128: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 129: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 130: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 131: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 132: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 133: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 134: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 135: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 136: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 137: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 138: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 139: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 140: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 141: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 142: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 143: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 144: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 145: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 146: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 147: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 148: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 149: use consistent naming conventions and document all public APIs.\n- Follow coding standard rule 150: use consistent naming conventions and document all public APIs.\n"
    },
    {
      "id": "CC-MEM-010",
      "name": "README Duplication",
      "severity": "MEDIUM",
      "category": "claude-memory",
      "evidence": {
        "source_type": "community",
        "source_urls": [
          "https://github.com/anthropics/claude-code/tree/main/.claude/commands"
        ],
        "verified_on": "2026-02-09",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "# Project Memory\n\nProject-specific agent instructions:\n- Always run tests before committing\n- Use feature branches for changes",
      "bad_example": "# My Project\n\nThis project validates agent configurations using Rust for performance.\n\n(Content duplicated verbatim from README.md)"
    },
    {
      "id": "CC-MEM-011",
      "name": "Invalid Paths Glob in Rules",
      "severity": "HIGH",
      "category": "claude-memory",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/memory"
        ],
        "verified_on": "2026-02-07",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "---\npaths:\n  - \"src/**/*.ts\"\n  - \"lib/**/*.js\"\n---\n# TypeScript Guidelines\n\nAlways use strict mode.",
      "bad_example": "---\npaths:\n  - \"[unclosed\"\n---\n# TypeScript Guidelines\n\nAlways use strict mode."
    },
    {
      "id": "CC-MEM-012",
      "name": "Rules File Unknown Frontmatter Key",
      "severity": "MEDIUM",
      "category": "claude-memory",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/memory"
        ],
        "verified_on": "2026-02-07",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "unsafe"
      },
      "good_example": "---\npaths:\n  - \"src/**/*.ts\"\n---\n# TypeScript Guidelines\n\nAlways use strict mode.",
      "bad_example": "---\npaths:\n  - \"src/**/*.ts\"\ndescription: \"some rule\"\nalwaysApply: true\n---\n# TypeScript Guidelines\n\nAlways use strict mode."
    },
    {
      "id": "CC-OS-001",
      "name": "Output Style Missing Description",
      "severity": "LOW",
      "category": "claude-output-styles",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/output-styles"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "---\nname: Concise\ndescription: Short, direct replies\n---\nBe brief.",
      "bad_example": "---\nname: Concise\n---\nBe brief."
    },
    {
      "id": "CC-OS-002",
      "name": "Output Style Invalid keep-coding-instructions Type",
      "severity": "HIGH",
      "category": "claude-output-styles",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/output-styles"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "---\nname: Concise\ndescription: Short replies\nkeep-coding-instructions: true\n---\nBe brief.",
      "bad_example": "---\nname: Concise\ndescription: Short replies\nkeep-coding-instructions: \"yes\"\n---\nBe brief."
    },
    {
      "id": "CC-OS-003",
      "name": "Output Style Unknown Frontmatter Key",
      "severity": "MEDIUM",
      "category": "claude-output-styles",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/output-styles"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "---\nname: Concise\ndescription: Short replies\nkeep-coding-instructions: false\n---\nBe brief.",
      "bad_example": "---\nname: Concise\ndescription: Short replies\nalwaysApply: true\n---\nBe brief."
    },
    {
      "id": "CC-OS-004",
      "name": "Output Style Empty Body",
      "severity": "MEDIUM",
      "category": "claude-output-styles",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/output-styles"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "---\nname: Concise\ndescription: Short replies\n---\nBe brief and direct.",
      "bad_example": "---\nname: Concise\ndescription: Short replies\n---\n"
    },
    {
      "id": "CC-OS-005",
      "name": "Output Style Name Exceeds Length",
      "severity": "LOW",
      "category": "claude-output-styles",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/output-styles"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "---\nname: Concise\ndescription: Short replies\n---\nBe brief.",
      "bad_example": "---\nname: A very very very very very very very very very very long output style name\ndescription: Short\n---\nBe brief."
    },
    {
      "id": "CC-OS-006",
      "name": "Invalid Output Style Frontmatter Syntax",
      "severity": "HIGH",
      "category": "claude-output-styles",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/output-styles"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": false,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "---\nname: Concise\ndescription: Short replies\n---\nBe brief.",
      "bad_example": "---\nname: Concise\ndescription: Short replies"
    },
    {
      "id": "CC-MEM-014",
      "name": "CLAUDE.md Exceeds Line Limit",
      "severity": "MEDIUM",
      "category": "claude-memory",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/memory"
        ],
        "verified_on": "2026-03-28",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": false,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "# Project\n\nKeep CLAUDE.md concise and focused.",
      "bad_example": "# Project\n\n(200+ lines of instructions that exceed recommended limits)"
    },
    {
      "id": "CC-PL-001",
      "name": "Plugin Manifest Not in .claude-plugin/",
      "severity": "HIGH",
      "category": "claude-plugins",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/plugins"
        ],
        "verified_on": "2026-02-04",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"manifest_path\": \".claude-plugin/plugin.json\"\n}",
      "bad_example": "{\n  \"manifest_path\": \"plugin.json\"\n}"
    },
    {
      "id": "CC-PL-002",
      "name": "Components in .claude-plugin/",
      "severity": "HIGH",
      "category": "claude-plugins",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/plugins-reference"
        ],
        "verified_on": "2026-02-04",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"name\": \"my-plugin\",\n  \"description\": \"A useful plugin\",\n  \"version\": \"1.0.0\"\n}",
      "bad_example": "{\n  \"name\": \"my-plugin\",\n  \"description\": \"A useful plugin\",\n  \"version\": \"1.0.0\",\n  \"skills\": \"./.claude-plugin/skills\"\n}"
    },
    {
      "id": "CC-PL-003",
      "name": "Invalid Semver",
      "severity": "HIGH",
      "category": "claude-plugins",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/plugins-reference"
        ],
        "verified_on": "2026-02-04",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe"
      },
      "good_example": "{\n  \"name\": \"my-plugin\",\n  \"description\": \"A useful plugin\",\n  \"version\": \"1.0.0\"\n}",
      "bad_example": "{\n  \"name\": \"my-plugin\",\n  \"description\": \"A useful plugin\",\n  \"version\": \"1.0\"\n}"
    },
    {
      "id": "CC-PL-004",
      "name": "Missing Required/Recommended Plugin Field",
      "severity": "HIGH",
      "category": "claude-plugins",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/plugins-reference"
        ],
        "verified_on": "2026-02-04",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"name\": \"my-plugin\",\n  \"description\": \"A useful plugin\",\n  \"version\": \"1.0.0\"\n}",
      "bad_example": "{}"
    },
    {
      "id": "CC-PL-005",
      "name": "Empty Plugin Name",
      "severity": "HIGH",
      "category": "claude-plugins",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/plugins-reference"
        ],
        "verified_on": "2026-02-04",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "unsafe"
      },
      "good_example": "{\n  \"name\": \"my-plugin\",\n  \"description\": \"A useful plugin\",\n  \"version\": \"1.0.0\"\n}",
      "bad_example": "{\n  \"name\": \"  \",\n  \"description\": \"A useful plugin\",\n  \"version\": \"1.0.0\"\n}"
    },
    {
      "id": "CC-PL-006",
      "name": "Plugin Parse Error",
      "severity": "HIGH",
      "category": "claude-plugins",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/plugins-reference"
        ],
        "verified_on": "2026-02-04",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"name\": \"my-plugin\",\n  \"description\": \"A useful plugin\",\n  \"version\": \"1.0.0\"\n}",
      "bad_example": "{ name: my-plugin, version: 1.0.0 }"
    },
    {
      "id": "CC-PL-007",
      "name": "Invalid Component Path",
      "severity": "HIGH",
      "category": "claude-plugins",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/plugins-reference"
        ],
        "verified_on": "2026-02-07",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe"
      },
      "good_example": "{\n  \"name\": \"my-plugin\",\n  \"description\": \"A useful plugin\",\n  \"version\": \"1.0.0\",\n  \"commands\": \"./commands/\"\n}",
      "bad_example": "{\n  \"name\": \"my-plugin\",\n  \"description\": \"A useful plugin\",\n  \"version\": \"1.0.0\",\n  \"commands\": \"/usr/local/bin/cmd\"\n}"
    },
    {
      "id": "CC-PL-008",
      "name": "Component Inside .claude-plugin",
      "severity": "HIGH",
      "category": "claude-plugins",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/plugins-reference"
        ],
        "verified_on": "2026-02-07",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"name\": \"my-plugin\",\n  \"description\": \"A useful plugin\",\n  \"version\": \"1.0.0\",\n  \"agents\": \"./agents/\"\n}",
      "bad_example": "{\n  \"name\": \"my-plugin\",\n  \"description\": \"A useful plugin\",\n  \"version\": \"1.0.0\",\n  \"agents\": \".claude-plugin/agents\"\n}"
    },
    {
      "id": "CC-PL-009",
      "name": "Invalid Author Object",
      "severity": "MEDIUM",
      "category": "claude-plugins",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/plugins-reference"
        ],
        "verified_on": "2026-02-07",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"name\": \"my-plugin\",\n  \"description\": \"A useful plugin\",\n  \"version\": \"1.0.0\",\n  \"author\": { \"name\": \"Jane Doe\" }\n}",
      "bad_example": "{\n  \"name\": \"my-plugin\",\n  \"description\": \"A useful plugin\",\n  \"version\": \"1.0.0\",\n  \"author\": { \"email\": \"jane@example.com\" }\n}"
    },
    {
      "id": "CC-PL-010",
      "name": "Invalid Homepage URL",
      "severity": "MEDIUM",
      "category": "claude-plugins",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/plugins-reference"
        ],
        "verified_on": "2026-02-07",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"name\": \"my-plugin\",\n  \"description\": \"A useful plugin\",\n  \"version\": \"1.0.0\",\n  \"homepage\": \"https://example.com/my-plugin\"\n}",
      "bad_example": "{\n  \"name\": \"my-plugin\",\n  \"description\": \"A useful plugin\",\n  \"version\": \"1.0.0\",\n  \"homepage\": \"not-a-valid-url\"\n}"
    },
    {
      "id": "CC-PL-011",
      "name": "LSP Server Missing Required Fields",
      "severity": "HIGH",
      "category": "claude-plugins",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/plugins-reference"
        ],
        "verified_on": "2026-03-28",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": false,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"lsp\": { \"command\": \"node\", \"args\": [\"server.js\"], \"languages\": [\"typescript\"] }\n}",
      "bad_example": "{\n  \"lsp\": { \"command\": \"node\" }\n}"
    },
    {
      "id": "CC-PL-012",
      "name": "Invalid UserConfig Key",
      "severity": "MEDIUM",
      "category": "claude-plugins",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/plugins-reference"
        ],
        "verified_on": "2026-03-28",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": false,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"userConfig\": { \"apiKey\": { \"type\": \"string\" } }\n}",
      "bad_example": "{\n  \"userConfig\": { \"api key!\": { \"type\": \"string\" } }\n}"
    },
    {
      "id": "CC-PL-013",
      "name": "Channel Missing Server Reference",
      "severity": "MEDIUM",
      "category": "claude-plugins",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/plugins-reference"
        ],
        "verified_on": "2026-03-28",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": false,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"channels\": [{ \"name\": \"stable\", \"server\": \"https://example.com\" }]\n}",
      "bad_example": "{\n  \"channels\": [{ \"name\": \"stable\" }]\n}"
    },
    {
      "id": "CC-PL-014",
      "name": "Plugin Agent Unsupported Field",
      "severity": "MEDIUM",
      "category": "claude-plugins",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/plugins-reference"
        ],
        "verified_on": "2026-03-28",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": false,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe"
      },
      "good_example": "{\n  \"agents\": [{ \"name\": \"helper\", \"description\": \"Assists with code\" }]\n}",
      "bad_example": "{\n  \"agents\": [{ \"name\": \"helper\", \"priority\": 1 }]\n}"
    },
    {
      "id": "CC-PL-015",
      "name": "Default Component Folder Shadowed by Manifest",
      "severity": "MEDIUM",
      "category": "claude-plugins",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://github.com/anthropics/claude-code/releases/tag/v2.1.140"
        ],
        "verified_on": "2026-05-14",
        "applies_to": {
          "tool": "claude-code",
          "version_range": ">=2.1.140"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": false,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"commands\": [\"./custom-commands\", \"./commands\"]\n}",
      "bad_example": "{\n  \"commands\": \"./custom-commands\"\n}"
    },
    {
      "id": "CC-SK-001",
      "name": "Invalid Model Value",
      "severity": "HIGH",
      "category": "claude-skills",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/skills"
        ],
        "verified_on": "2026-02-04",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "unsafe"
      },
      "good_example": "---\nname: fast-review\ndescription: Use when doing quick code reviews\nmodel: haiku\n---\nReview the code for obvious issues.",
      "bad_example": "---\nname: fast-review\ndescription: Use when doing quick code reviews\nmodel: gpt-4\n---\nReview the code for obvious issues."
    },
    {
      "id": "CC-SK-002",
      "name": "Invalid Context Value",
      "severity": "HIGH",
      "category": "claude-skills",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/skills"
        ],
        "verified_on": "2026-02-04",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "unsafe"
      },
      "good_example": "---\nname: parallel-task\ndescription: Use when running tasks in parallel\ncontext: fork\nagent: general-purpose\n---\nRun the task in a forked context.",
      "bad_example": "---\nname: parallel-task\ndescription: Use when running tasks in parallel\ncontext: spawn\nagent: general-purpose\n---\nRun the task in a spawned context."
    },
    {
      "id": "CC-SK-003",
      "name": "Context Without Agent",
      "severity": "HIGH",
      "category": "claude-skills",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/skills"
        ],
        "verified_on": "2026-02-04",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "unsafe"
      },
      "good_example": "---\nname: sub-task\ndescription: Use when delegating work to a sub-agent\ncontext: fork\nagent: general-purpose\n---\nDelegate the task to a sub-agent.",
      "bad_example": "---\nname: sub-task\ndescription: Use when delegating work to a sub-agent\ncontext: fork\n---\nDelegate the task to a sub-agent."
    },
    {
      "id": "CC-SK-004",
      "name": "Agent Without Context",
      "severity": "HIGH",
      "category": "claude-skills",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/skills"
        ],
        "verified_on": "2026-02-04",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "unsafe"
      },
      "good_example": "---\nname: explore-code\ndescription: Use when exploring the codebase\ncontext: fork\nagent: Explore\n---\nExplore the codebase structure.",
      "bad_example": "---\nname: explore-code\ndescription: Use when exploring the codebase\nagent: Explore\n---\nExplore the codebase structure."
    },
    {
      "id": "CC-SK-005",
      "name": "Invalid Agent Type",
      "severity": "HIGH",
      "category": "claude-skills",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/sub-agents"
        ],
        "verified_on": "2026-02-04",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "unsafe"
      },
      "good_example": "---\nname: search-files\ndescription: Use when searching for files in the project\ncontext: fork\nagent: Explore\n---\nSearch the project for relevant files.",
      "bad_example": "---\nname: search-files\ndescription: Use when searching for files in the project\ncontext: fork\nagent: Invalid Agent!!\n---\nSearch the project for relevant files."
    },
    {
      "id": "CC-SK-006",
      "name": "Dangerous Auto-Invocation",
      "severity": "HIGH",
      "category": "claude-skills",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/skills"
        ],
        "verified_on": "2026-02-04",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "unsafe"
      },
      "good_example": "---\nname: deploy-staging\ndescription: Use when deploying to staging environment\ndisable-model-invocation: true\n---\nDeploy the application to staging.",
      "bad_example": "---\nname: deploy-staging\ndescription: Use when deploying to staging environment\n---\nDeploy the application to staging."
    },
    {
      "id": "CC-SK-007",
      "name": "Unrestricted Bash",
      "severity": "MEDIUM",
      "category": "claude-skills",
      "evidence": {
        "source_type": "community",
        "source_urls": [
          "https://github.com/anthropics/claude-code/tree/main/.claude/commands"
        ],
        "verified_on": "2026-02-09",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "unsafe"
      },
      "good_example": "---\nname: git-status\ndescription: Use when checking git status\nallowed-tools: Bash(git:*), Read\n---\nRun git status and read the output.",
      "bad_example": "---\nname: git-status\ndescription: Use when checking git status\nallowed-tools: Bash, Read\n---\nRun git status and read the output."
    },
    {
      "id": "CC-SK-008",
      "name": "Unknown Tool Name",
      "severity": "HIGH",
      "category": "claude-skills",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/settings"
        ],
        "verified_on": "2026-02-04",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "---\nname: find-files\ndescription: Use when finding files by pattern\nallowed-tools: Glob, Grep, Read\n---\nSearch for files matching the pattern.",
      "bad_example": "---\nname: find-files\ndescription: Use when finding files by pattern\nallowed-tools: Glob, Grep, FooBar\n---\nSearch for files matching the pattern."
    },
    {
      "id": "CC-SK-009",
      "name": "Too Many Injections",
      "severity": "MEDIUM",
      "category": "claude-skills",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://platform.claude.com/docs"
        ],
        "verified_on": "2026-02-04",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "---\nname: template-skill\ndescription: Use when applying a code template\n---\nApply the template with !`config.json` values.",
      "bad_example": "---\nname: template-skill\ndescription: Use when applying a code template\n---\nUse !`config.json` and !`env.json` and !`secrets.json` and !`overrides.json` for setup."
    },
    {
      "id": "CC-SK-010",
      "name": "Invalid Hooks in Skill Frontmatter",
      "severity": "HIGH",
      "category": "claude-skills",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/skills"
        ],
        "verified_on": "2026-02-07",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "---\nname: hook-skill\ndescription: Use when running a skill with hooks\nhooks:\n  PreToolUse:\n    - type: command\n      command: echo pre\n---\nRun with hooks.",
      "bad_example": "---\nname: hook-skill\ndescription: Use when running a skill with hooks\nhooks:\n  InvalidEvent:\n    - type: command\n      command: echo bad\n---\nRun with hooks."
    },
    {
      "id": "CC-SK-011",
      "name": "Unreachable Skill",
      "severity": "HIGH",
      "category": "claude-skills",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/skills"
        ],
        "verified_on": "2026-02-07",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "unsafe"
      },
      "good_example": "---\nname: internal-skill\ndescription: Use when running internal automation\nuser-invocable: false\n---\nThis skill can still be invoked by the model.",
      "bad_example": "---\nname: internal-skill\ndescription: Use when running internal automation\nuser-invocable: false\ndisable-model-invocation: true\n---\nThis skill cannot be reached by anyone."
    },
    {
      "id": "CC-SK-012",
      "name": "Argument Hint Without $ARGUMENTS",
      "severity": "MEDIUM",
      "category": "claude-skills",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/skills"
        ],
        "verified_on": "2026-02-07",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "unsafe"
      },
      "good_example": "---\nname: greet-user\ndescription: Use when greeting a user by name\nargument-hint: Enter the user's name\n---\nGreet the user: Hello, $ARGUMENTS!",
      "bad_example": "---\nname: greet-user\ndescription: Use when greeting a user by name\nargument-hint: Enter the user's name\n---\nGreet the user with a friendly message."
    },
    {
      "id": "CC-SK-013",
      "name": "Fork Context Without Actionable Instructions",
      "severity": "MEDIUM",
      "category": "claude-skills",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/skills"
        ],
        "verified_on": "2026-02-07",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "---\nname: analyze-code\ndescription: Use when analyzing code quality\ncontext: fork\nagent: general-purpose\n---\nRun static analysis on the codebase and report findings.",
      "bad_example": "---\nname: analyze-code\ndescription: Use when analyzing code quality\ncontext: fork\nagent: general-purpose\n---\nThis is some informational text without any actionable verbs."
    },
    {
      "id": "CC-SK-014",
      "name": "Invalid disable-model-invocation Type",
      "severity": "HIGH",
      "category": "claude-skills",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/skills"
        ],
        "verified_on": "2026-02-07",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe"
      },
      "good_example": "---\nname: quiet-skill\ndescription: Use when running without model invocation\ndisable-model-invocation: true\n---\nRun silently.",
      "bad_example": "---\nname: quiet-skill\ndescription: Use when running without model invocation\ndisable-model-invocation: \"true\"\n---\nRun silently."
    },
    {
      "id": "CC-SK-015",
      "name": "Invalid user-invocable Type",
      "severity": "HIGH",
      "category": "claude-skills",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/skills"
        ],
        "verified_on": "2026-02-07",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe"
      },
      "good_example": "---\nname: slash-cmd\ndescription: Use when user types the slash command\nuser-invocable: true\n---\nHandle the slash command.",
      "bad_example": "---\nname: slash-cmd\ndescription: Use when user types the slash command\nuser-invocable: \"false\"\n---\nHandle the slash command."
    },
    {
      "id": "CC-SK-016",
      "name": "Indexed $ARGUMENTS Without argument-hint",
      "severity": "MEDIUM",
      "category": "claude-skills",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/skills"
        ],
        "verified_on": "2026-02-14",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "---\nname: run-check\ndescription: Use when validating a provided path\nargument-hint: path-to-target\n---\nRun checks against $ARGUMENTS[0].",
      "bad_example": "---\nname: run-check\ndescription: Use when validating a provided path\n---\nRun checks against $ARGUMENTS[0]."
    },
    {
      "id": "CC-SK-017",
      "name": "Unknown Frontmatter Field",
      "severity": "MEDIUM",
      "category": "claude-skills",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/skills"
        ],
        "verified_on": "2026-02-14",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "---\nname: lint-config\ndescription: Use when validating configuration files\nallowed-tools: Read, Grep\n---\nLint project configuration files.",
      "bad_example": "---\nname: lint-config\ndescription: Use when validating configuration files\nallowed_tools: Read, Grep\n---\nLint project configuration files."
    },
    {
      "id": "CC-SK-018",
      "name": "Invalid Effort Value",
      "severity": "MEDIUM",
      "category": "claude-skills",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/skills"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": false,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "unsafe"
      },
      "good_example": "---\nname: my-skill\neffort: high\n---\nSkill instructions.",
      "bad_example": "---\nname: my-skill\neffort: maximum\n---\nSkill instructions."
    },
    {
      "id": "CC-SK-019",
      "name": "Invalid Paths Format",
      "severity": "LOW",
      "category": "claude-skills",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/skills"
        ],
        "verified_on": "2026-03-28",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": false,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "---\nname: my-skill\npaths:\n  - \"src/**/*.ts\"\n---\nSkill instructions.",
      "bad_example": "---\nname: my-skill\npaths: src/**/*.ts\n---\nSkill instructions."
    },
    {
      "id": "CC-SK-020",
      "name": "Invalid Shell Value",
      "severity": "MEDIUM",
      "category": "claude-skills",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/skills"
        ],
        "verified_on": "2026-03-28",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": false,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "unsafe"
      },
      "good_example": "---\nname: my-skill\nshell: bash\n---\nSkill instructions.",
      "bad_example": "---\nname: my-skill\nshell: zsh\n---\nSkill instructions."
    },
    {
      "id": "CC-SK-021",
      "name": "Hardcoded User Directory Path",
      "severity": "MEDIUM",
      "category": "claude-skills",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/skills"
        ],
        "verified_on": "2026-04-26",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "---\nname: build-helper\ndescription: Build the project\n---\nRun `cargo build` from the repo root, or set `$BUILD_DIR` to override.",
      "bad_example": "---\nname: build-helper\ndescription: Build the project\n---\nRun the script at /Users/alice/projects/myrepo/build.sh to compile."
    },
    {
      "id": "CC-SET-001",
      "name": "Invalid prUrlTemplate Setting",
      "severity": "MEDIUM",
      "category": "claude-settings",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.claude.com/docs/en/settings"
        ],
        "verified_on": "2026-04-26",
        "applies_to": {
          "tool": "claude-code"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"prUrlTemplate\": \"https://reviews.example.com/{owner}/{repo}/pull/{number}\"\n}",
      "bad_example": "{\n  \"prUrlTemplate\": \"https://reviews.example.com/\"\n}"
    },
    {
      "id": "CC-SET-002",
      "name": "Non-boolean channelsEnabled Setting",
      "severity": "MEDIUM",
      "category": "claude-settings",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://github.com/anthropics/claude-code/releases/tag/v2.1.128"
        ],
        "verified_on": "2026-05-06",
        "applies_to": {
          "tool": "claude-code",
          "version_range": ">=2.1.128"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": false,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"channelsEnabled\": true\n}",
      "bad_example": "{\n  \"channelsEnabled\": \"true\"\n}"
    },
    {
      "id": "CC-SET-003",
      "name": "Invalid worktree.baseRef Value",
      "severity": "MEDIUM",
      "category": "claude-settings",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://github.com/anthropics/claude-code/releases/tag/v2.1.133"
        ],
        "verified_on": "2026-05-08",
        "applies_to": {
          "tool": "claude-code",
          "version_range": ">=2.1.133"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": false,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"worktree\": {\"baseRef\": \"fresh\"}\n}",
      "bad_example": "{\n  \"worktree\": {\"baseRef\": \"main\"}\n}"
    },
    {
      "id": "CC-SET-004",
      "name": "Invalid Sandbox Path Setting",
      "severity": "MEDIUM",
      "category": "claude-settings",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://github.com/anthropics/claude-code/releases/tag/v2.1.133"
        ],
        "verified_on": "2026-05-08",
        "applies_to": {
          "tool": "claude-code",
          "version_range": ">=2.1.133",
          "platform": "linux/wsl"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": false,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"sandbox\": {\"bwrapPath\": \"/usr/local/bin/bwrap\", \"socatPath\": \"/usr/bin/socat\"}\n}",
      "bad_example": "{\n  \"sandbox\": {\"bwrapPath\": \"\", \"socatPath\": 42}\n}"
    },
    {
      "id": "CC-SET-005",
      "name": "Invalid parentSettingsBehavior Value",
      "severity": "MEDIUM",
      "category": "claude-settings",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://github.com/anthropics/claude-code/releases/tag/v2.1.133"
        ],
        "verified_on": "2026-05-08",
        "applies_to": {
          "tool": "claude-code",
          "version_range": ">=2.1.133"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": false,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"parentSettingsBehavior\": \"first-wins\"\n}",
      "bad_example": "{\n  \"parentSettingsBehavior\": \"override\"\n}"
    },
    {
      "id": "CC-SET-006",
      "name": "Non-boolean disableBundledSkills Setting",
      "severity": "MEDIUM",
      "category": "claude-settings",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://github.com/anthropics/claude-code/releases/tag/v2.1.169",
          "https://code.claude.com/docs/en/settings"
        ],
        "verified_on": "2026-06-11",
        "applies_to": {
          "tool": "claude-code",
          "version_range": ">=2.1.169"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": false,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"disableBundledSkills\": true\n}",
      "bad_example": "{\n  \"disableBundledSkills\": \"true\"\n}"
    },
    {
      "id": "CC-SET-007",
      "name": "Non-boolean enforceAvailableModels Setting",
      "severity": "MEDIUM",
      "category": "claude-settings",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://github.com/anthropics/claude-code/releases/tag/v2.1.175",
          "https://code.claude.com/docs/en/settings"
        ],
        "verified_on": "2026-06-16",
        "applies_to": {
          "tool": "claude-code",
          "version_range": ">=2.1.175"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": false,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"enforceAvailableModels\": true\n}",
      "bad_example": "{\n  \"enforceAvailableModels\": \"true\"\n}"
    },
    {
      "id": "CC-SET-008",
      "name": "Non-boolean sandbox.allowAppleEvents Setting",
      "severity": "MEDIUM",
      "category": "claude-settings",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://github.com/anthropics/claude-code/releases/tag/v2.1.181",
          "https://code.claude.com/docs/en/settings"
        ],
        "verified_on": "2026-06-18",
        "applies_to": {
          "tool": "claude-code",
          "version_range": ">=2.1.181",
          "platform": "macos"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": false,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"sandbox\": {\"allowAppleEvents\": true}\n}",
      "bad_example": "{\n  \"sandbox\": {\"allowAppleEvents\": \"true\"}\n}"
    },
    {
      "id": "CC-SET-009",
      "name": "Non-boolean attribution.sessionUrl Setting",
      "severity": "MEDIUM",
      "category": "claude-settings",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://github.com/anthropics/claude-code/releases/tag/v2.1.183",
          "https://code.claude.com/docs/en/settings"
        ],
        "verified_on": "2026-06-21",
        "applies_to": {
          "tool": "claude-code",
          "version_range": ">=2.1.183"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": false,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"attribution\": {\"sessionUrl\": false}\n}",
      "bad_example": "{\n  \"attribution\": {\"sessionUrl\": \"false\"}\n}"
    },
    {
      "id": "CDX-000",
      "name": "TOML Parse Error",
      "severity": "HIGH",
      "category": "codex",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://developers.openai.com/codex/"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "codex"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "[model]\napprovalMode = \"suggest\"\nfullAutoErrorMode = \"ask-user\"",
      "bad_example": "[model\napprovalMode = suggest"
    },
    {
      "id": "CDX-001",
      "name": "Invalid Approval Mode",
      "severity": "HIGH",
      "category": "codex",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://developers.openai.com/codex/"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "codex"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "unsafe"
      },
      "good_example": "approvalMode = \"suggest\"",
      "bad_example": "approvalMode = \"yolo\""
    },
    {
      "id": "CDX-002",
      "name": "Invalid Full Auto Error Mode",
      "severity": "HIGH",
      "category": "codex",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://developers.openai.com/codex/"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "codex"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "unsafe"
      },
      "good_example": "fullAutoErrorMode = \"ask-user\"",
      "bad_example": "fullAutoErrorMode = \"crash\""
    },
    {
      "id": "CDX-003",
      "name": "AGENTS.override.md in Version Control",
      "severity": "MEDIUM",
      "category": "codex",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://developers.openai.com/codex/"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "codex"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "# AGENTS.md\n\nProject instructions for Codex CLI.",
      "bad_example": "# AGENTS.override.md\n\nLocal overrides that should not be committed to version control."
    },
    {
      "id": "CDX-004",
      "name": "Unknown Config Key",
      "severity": "MEDIUM",
      "category": "codex",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://developers.openai.com/codex/"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "codex"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe"
      },
      "good_example": "model = \"o4-mini\"\napprovalMode = \"suggest\"",
      "bad_example": "unknownKey = true"
    },
    {
      "id": "CDX-005",
      "name": "project_doc_max_bytes Exceeds Limit",
      "severity": "HIGH",
      "category": "codex",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://developers.openai.com/codex/"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "codex"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "project_doc_max_bytes = 32768",
      "bad_example": "project_doc_max_bytes = 100000"
    },
    {
      "id": "CDX-006",
      "name": "Invalid project_doc_fallback_filenames",
      "severity": "HIGH",
      "category": "codex",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://developers.openai.com/codex/guides/agents-md/"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "codex"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "project_doc_fallback_filenames = [\"AGENTS.md\", \"README.md\"]",
      "bad_example": "project_doc_fallback_filenames = [\"AGENTS.md\", \"\", 42, \"AGENTS.md\"]"
    },
    {
      "id": "CDX-CFG-001",
      "name": "Invalid approval_policy Value",
      "severity": "HIGH",
      "category": "codex",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://developers.openai.com/codex/config-reference",
          "https://developers.openai.com/codex/config-schema.json",
          "https://developers.openai.com/codex/enterprise/managed-configuration"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "codex"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "approval_policy = \"on-request\"",
      "bad_example": "approval_policy = \"always\""
    },
    {
      "id": "CDX-CFG-002",
      "name": "Invalid sandbox_mode Value",
      "severity": "HIGH",
      "category": "codex",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://developers.openai.com/codex/config-reference",
          "https://developers.openai.com/codex/config-schema.json",
          "https://developers.openai.com/codex/enterprise/managed-configuration"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "codex"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "sandbox_mode = \"workspace-write\"",
      "bad_example": "sandbox_mode = \"open\""
    },
    {
      "id": "CDX-CFG-003",
      "name": "Invalid model_reasoning_effort Value",
      "severity": "HIGH",
      "category": "codex",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://developers.openai.com/codex/config-reference",
          "https://developers.openai.com/codex/config-schema.json",
          "https://developers.openai.com/codex/enterprise/managed-configuration",
          "https://github.com/openai/codex/releases/tag/rust-v0.138.0"
        ],
        "verified_on": "2026-06-11",
        "applies_to": {
          "tool": "codex"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "model_reasoning_effort = \"high\"",
      "bad_example": "model_reasoning_effort = \"\""
    },
    {
      "id": "CDX-CFG-004",
      "name": "Invalid model_verbosity Value",
      "severity": "HIGH",
      "category": "codex",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://developers.openai.com/codex/config-reference",
          "https://developers.openai.com/codex/config-schema.json",
          "https://developers.openai.com/codex/enterprise/managed-configuration"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "codex"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "model_verbosity = \"medium\"",
      "bad_example": "model_verbosity = \"verbose\""
    },
    {
      "id": "CDX-CFG-005",
      "name": "Invalid personality Value",
      "severity": "HIGH",
      "category": "codex",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://developers.openai.com/codex/config-reference",
          "https://developers.openai.com/codex/config-schema.json",
          "https://developers.openai.com/codex/enterprise/managed-configuration"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "codex"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "personality = \"friendly\"",
      "bad_example": "personality = \"assistant\""
    },
    {
      "id": "CDX-CFG-006",
      "name": "Unknown Codex Config Field",
      "severity": "MEDIUM",
      "category": "codex",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://developers.openai.com/codex/config-reference",
          "https://developers.openai.com/codex/config-schema.json",
          "https://developers.openai.com/codex/enterprise/managed-configuration"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "codex"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "[features]\nmemories = true",
      "bad_example": "[features]\nunknown_flag = true"
    },
    {
      "id": "CDX-CFG-007",
      "name": "Danger Full Access Without Acknowledgment",
      "severity": "HIGH",
      "category": "codex",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://developers.openai.com/codex/config-reference",
          "https://developers.openai.com/codex/config-schema.json",
          "https://developers.openai.com/codex/enterprise/managed-configuration"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "codex"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "sandbox_mode = \"danger-full-access\"\n[notice]\nhide_full_access_warning = true",
      "bad_example": "sandbox_mode = \"danger-full-access\""
    },
    {
      "id": "CDX-CFG-008",
      "name": "Invalid shell_environment_policy.inherit Value",
      "severity": "HIGH",
      "category": "codex",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://developers.openai.com/codex/config-reference",
          "https://developers.openai.com/codex/config-schema.json",
          "https://developers.openai.com/codex/enterprise/managed-configuration"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "codex"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "[shell_environment_policy]\ninherit = \"core\"",
      "bad_example": "[shell_environment_policy]\ninherit = \"system\""
    },
    {
      "id": "CDX-CFG-009",
      "name": "Invalid MCP Server Structure in Codex Config",
      "severity": "HIGH",
      "category": "codex",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://developers.openai.com/codex/config-reference",
          "https://developers.openai.com/codex/config-schema.json",
          "https://developers.openai.com/codex/enterprise/managed-configuration"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "codex"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "[mcp_servers.local]\ncommand = \"npx\"\nargs = [\"-y\", \"@modelcontextprotocol/server-filesystem\"]",
      "bad_example": "[mcp_servers.local]\nenabled = true"
    },
    {
      "id": "CDX-CFG-010",
      "name": "Hardcoded Secret in Codex Config",
      "severity": "HIGH",
      "category": "codex",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://developers.openai.com/codex/config-reference",
          "https://developers.openai.com/codex/config-schema.json",
          "https://developers.openai.com/codex/enterprise/managed-configuration"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "codex"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "api_key = \"${OPENAI_API_KEY}\"",
      "bad_example": "api_key = \"sk-live-super-secret-value\""
    },
    {
      "id": "CDX-CFG-011",
      "name": "Invalid Feature Flag Name",
      "severity": "MEDIUM",
      "category": "codex",
      "evidence": {
        "source_type": "vendor_code",
        "source_urls": [
          "https://developers.openai.com/codex/config-reference",
          "https://github.com/openai/codex/blob/rust-v0.137.0/codex-rs/core/config.schema.json"
        ],
        "verified_on": "2026-06-04",
        "applies_to": {
          "tool": "codex"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "[features]\nmemories = true",
      "bad_example": "[features]\nfuture_flag = true"
    },
    {
      "id": "CDX-CFG-012",
      "name": "Invalid cli_auth_credentials_store Value",
      "severity": "HIGH",
      "category": "codex",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://developers.openai.com/codex/config-reference",
          "https://developers.openai.com/codex/config-schema.json",
          "https://developers.openai.com/codex/enterprise/managed-configuration"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "codex"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "cli_auth_credentials_store = \"keyring\"",
      "bad_example": "cli_auth_credentials_store = \"vault\""
    },
    {
      "id": "CDX-CFG-013",
      "name": "Invalid sandbox_workspace_write Mode",
      "severity": "HIGH",
      "category": "codex",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://developers.openai.com/codex/config-reference",
          "https://developers.openai.com/codex/config-schema.json"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "codex"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "[sandbox_workspace_write]\nmode = \"allowlist\"",
      "bad_example": "[sandbox_workspace_write]\nmode = \"yolo\""
    },
    {
      "id": "CDX-CFG-014",
      "name": "Invalid model Value",
      "severity": "MEDIUM",
      "category": "codex",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://developers.openai.com/codex/config-reference",
          "https://developers.openai.com/codex/config-schema.json"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "codex"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "model = \"o4-mini\"",
      "bad_example": "model = 123"
    },
    {
      "id": "CDX-CFG-015",
      "name": "Invalid model_provider Value",
      "severity": "HIGH",
      "category": "codex",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://developers.openai.com/codex/config-reference",
          "https://developers.openai.com/codex/config-schema.json"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "codex"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "model_provider = \"openai\"",
      "bad_example": "model_provider = 123"
    },
    {
      "id": "CDX-CFG-016",
      "name": "Invalid model_reasoning_summary Value",
      "severity": "MEDIUM",
      "category": "codex",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://developers.openai.com/codex/config-reference",
          "https://developers.openai.com/codex/config-schema.json"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "codex"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "model_reasoning_summary = \"auto\"",
      "bad_example": "model_reasoning_summary = 123"
    },
    {
      "id": "CDX-CFG-017",
      "name": "Invalid history Configuration",
      "severity": "MEDIUM",
      "category": "codex",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://developers.openai.com/codex/config-reference",
          "https://developers.openai.com/codex/config-schema.json"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "codex"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "[history]\npersistence = true\nmax_entries = 1000",
      "bad_example": "[history]\npersistence = \"yes\""
    },
    {
      "id": "CDX-CFG-018",
      "name": "Invalid tui Configuration",
      "severity": "MEDIUM",
      "category": "codex",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://developers.openai.com/codex/config-reference",
          "https://developers.openai.com/codex/config-schema.json"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "codex"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "[tui]\ntheme = \"dark\"\nnotifications = true",
      "bad_example": "[tui]\ntheme = 123"
    },
    {
      "id": "CDX-CFG-019",
      "name": "Invalid file_opener Value",
      "severity": "MEDIUM",
      "category": "codex",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://developers.openai.com/codex/config-reference",
          "https://developers.openai.com/codex/config-schema.json"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "codex"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "file_opener = \"vscode\"",
      "bad_example": "file_opener = 123"
    },
    {
      "id": "CDX-CFG-020",
      "name": "Invalid MCP OAuth Config",
      "severity": "HIGH",
      "category": "codex",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://developers.openai.com/codex/config-reference",
          "https://developers.openai.com/codex/config-schema.json"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "codex"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "mcp_oauth_credentials_store = \"file\"",
      "bad_example": "mcp_oauth_credentials_store = 123"
    },
    {
      "id": "CDX-CFG-021",
      "name": "Invalid model_context_window Value",
      "severity": "MEDIUM",
      "category": "codex",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://developers.openai.com/codex/config-reference",
          "https://developers.openai.com/codex/config-schema.json"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "codex"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "model_context_window = 128000",
      "bad_example": "model_context_window = \"big\""
    },
    {
      "id": "CDX-CFG-022",
      "name": "Invalid model_auto_compact_token_limit Value",
      "severity": "MEDIUM",
      "category": "codex",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://developers.openai.com/codex/config-reference",
          "https://developers.openai.com/codex/config-schema.json"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "codex"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "model_auto_compact_token_limit = 80000",
      "bad_example": "model_auto_compact_token_limit = \"lots\""
    },
    {
      "id": "CDX-AG-001",
      "name": "Empty AGENTS.md for Codex",
      "severity": "HIGH",
      "category": "codex",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://developers.openai.com/codex/guides/agents-md"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "codex"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "# AGENTS.md\n\nUse `cargo test` before opening PRs.",
      "bad_example": ""
    },
    {
      "id": "CDX-AG-002",
      "name": "Secrets in AGENTS.md for Codex",
      "severity": "HIGH",
      "category": "codex",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://developers.openai.com/codex/guides/agents-md"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "codex"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "Use `${OPENAI_API_KEY}` from the environment.",
      "bad_example": "OPENAI_API_KEY=sk-live-super-secret-value"
    },
    {
      "id": "CDX-AG-003",
      "name": "Generic AGENTS.md Guidance for Codex",
      "severity": "MEDIUM",
      "category": "codex",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://developers.openai.com/codex/guides/agents-md"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "codex"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "Run `cargo test -p agnix-core` and `cargo test -p agnix-cli` before merge.",
      "bad_example": "Be helpful and accurate."
    },
    {
      "id": "CDX-AG-004",
      "name": "AGENTS.md Exceeds Size Limit",
      "severity": "MEDIUM",
      "category": "codex",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://developers.openai.com/codex/guides/agents-md"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "codex"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "# AGENTS.md\n\nConcise project instructions.",
      "bad_example": "# AGENTS.md\n\[encoded data, 100002 characters]"
    },
    {
      "id": "CDX-AG-005",
      "name": "AGENTS.md References Missing File",
      "severity": "MEDIUM",
      "category": "codex",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://developers.openai.com/codex/guides/agents-md"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "codex"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "See `docs/setup.md` for details.",
      "bad_example": "See `docs/nonexistent.md` for details."
    },
    {
      "id": "CDX-AG-006",
      "name": "AGENTS.md Missing Project Context",
      "severity": "LOW",
      "category": "codex",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://developers.openai.com/codex/guides/agents-md"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "codex"
        },
        "normative_level": "BEST_PRACTICE",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "# AGENTS.md\n\nThis is a Rust project using cargo.\n\n## Commands\n\n`cargo test`",
      "bad_example": "# AGENTS.md\n\nFollow best practices."
    },
    {
      "id": "CDX-AG-007",
      "name": "AGENTS.md Contradicts config.toml",
      "severity": "MEDIUM",
      "category": "codex",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://developers.openai.com/codex/guides/agents-md"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "codex"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "Use full-auto mode for CI.\n\napprovalMode = \"full-auto\"",
      "bad_example": "Use suggest mode.\n\napprovalMode = \"full-auto\""
    },
    {
      "id": "CDX-APP-001",
      "name": "Invalid default_tools_approval_mode Value",
      "severity": "HIGH",
      "category": "codex",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://developers.openai.com/codex/config-reference",
          "https://developers.openai.com/codex/config-schema.json",
          "https://developers.openai.com/codex/enterprise/managed-configuration"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "codex"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "[apps.github]\ndefault_tools_approval_mode = \"prompt\"",
      "bad_example": "[apps.github]\ndefault_tools_approval_mode = \"manual\""
    },
    {
      "id": "CDX-APP-002",
      "name": "Invalid skills Configuration",
      "severity": "MEDIUM",
      "category": "codex",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://developers.openai.com/codex/config-reference",
          "https://developers.openai.com/codex/config-schema.json"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "codex"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "[skills]\nmax_concurrent = 3",
      "bad_example": "[skills]\nmax_concurrent = \"many\""
    },
    {
      "id": "CDX-APP-003",
      "name": "Invalid profile Configuration",
      "severity": "MEDIUM",
      "category": "codex",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://developers.openai.com/codex/config-reference",
          "https://developers.openai.com/codex/config-schema.json"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "codex"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "profile = \"default\"",
      "bad_example": "profile = 123"
    },
    {
      "id": "CDX-PL-001",
      "name": "Codex Plugin Manifest Location",
      "severity": "HIGH",
      "category": "codex",
      "evidence": {
        "source_type": "vendor_code",
        "source_urls": [
          "https://github.com/openai/codex/blob/rust-v0.137.0/codex-rs/core-plugins/src/manifest.rs"
        ],
        "verified_on": "2026-06-04",
        "applies_to": {
          "tool": "codex",
          "version_range": ">=0.117.0"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": ".codex-plugin/plugin.json",
      "bad_example": "plugin.json (at project root)"
    },
    {
      "id": "CDX-PL-002",
      "name": "Invalid JSON in Plugin Manifest",
      "severity": "HIGH",
      "category": "codex",
      "evidence": {
        "source_type": "vendor_code",
        "source_urls": [
          "https://github.com/openai/codex/blob/rust-v0.137.0/codex-rs/core-plugins/src/manifest.rs"
        ],
        "verified_on": "2026-06-04",
        "applies_to": {
          "tool": "codex",
          "version_range": ">=0.117.0"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\"name\": \"my-plugin\", \"components\": [{\"path\": \"./src/index.js\"}]}",
      "bad_example": "{name: my-plugin, components: }"
    },
    {
      "id": "CDX-PL-003",
      "name": "Missing or Empty Plugin Name",
      "severity": "HIGH",
      "category": "codex",
      "evidence": {
        "source_type": "vendor_code",
        "source_urls": [
          "https://github.com/openai/codex/blob/rust-v0.137.0/codex-rs/core-plugins/src/manifest.rs"
        ],
        "verified_on": "2026-06-04",
        "applies_to": {
          "tool": "codex",
          "version_range": ">=0.117.0"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "unsafe"
      },
      "good_example": "{\"name\": \"my-plugin\"}",
      "bad_example": "{\"name\": \"\"}"
    },
    {
      "id": "CDX-PL-004",
      "name": "Invalid Plugin Name Characters",
      "severity": "HIGH",
      "category": "codex",
      "evidence": {
        "source_type": "vendor_code",
        "source_urls": [
          "https://github.com/openai/codex/blob/rust-v0.137.0/codex-rs/core-plugins/src/manifest.rs"
        ],
        "verified_on": "2026-06-04",
        "applies_to": {
          "tool": "codex",
          "version_range": ">=0.117.0"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\"name\": \"my-cool-plugin\"}",
      "bad_example": "{\"name\": \"my plugin!@#\"}"
    },
    {
      "id": "CDX-PL-005",
      "name": "Component Path Missing ./ Prefix",
      "severity": "HIGH",
      "category": "codex",
      "evidence": {
        "source_type": "vendor_code",
        "source_urls": [
          "https://github.com/openai/codex/blob/rust-v0.137.0/codex-rs/core-plugins/src/manifest.rs"
        ],
        "verified_on": "2026-06-04",
        "applies_to": {
          "tool": "codex",
          "version_range": ">=0.117.0"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe"
      },
      "good_example": "{\"name\": \"my-plugin\", \"skills\": \"./src\"}",
      "bad_example": "{\"name\": \"my-plugin\", \"skills\": \"src\"}"
    },
    {
      "id": "CDX-PL-006",
      "name": "Component Path Directory Traversal",
      "severity": "HIGH",
      "category": "codex",
      "evidence": {
        "source_type": "vendor_code",
        "source_urls": [
          "https://github.com/openai/codex/blob/rust-v0.137.0/codex-rs/core-plugins/src/manifest.rs"
        ],
        "verified_on": "2026-06-04",
        "applies_to": {
          "tool": "codex",
          "version_range": ">=0.117.0"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\"name\": \"my-plugin\", \"mcpServers\": \"./servers\"}",
      "bad_example": "{\"name\": \"my-plugin\", \"mcpServers\": \"./../../../etc/passwd\"}"
    },
    {
      "id": "CDX-PL-007",
      "name": "Component Path Empty Relative",
      "severity": "HIGH",
      "category": "codex",
      "evidence": {
        "source_type": "vendor_code",
        "source_urls": [
          "https://github.com/openai/codex/blob/rust-v0.137.0/codex-rs/core-plugins/src/manifest.rs"
        ],
        "verified_on": "2026-06-04",
        "applies_to": {
          "tool": "codex",
          "version_range": ">=0.117.0"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\"name\": \"my-plugin\", \"apps\": \"./apps\"}",
      "bad_example": "{\"name\": \"my-plugin\", \"apps\": \"./\"}"
    },
    {
      "id": "CDX-PL-008",
      "name": "Too Many Default Prompts",
      "severity": "MEDIUM",
      "category": "codex",
      "evidence": {
        "source_type": "vendor_code",
        "source_urls": [
          "https://github.com/openai/codex/blob/rust-v0.137.0/codex-rs/core-plugins/src/manifest.rs"
        ],
        "verified_on": "2026-06-04",
        "applies_to": {
          "tool": "codex",
          "version_range": ">=0.117.0"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\"name\": \"my-plugin\", \"interface\": {\"defaultPrompt\": [\"Fix the bug\", \"Add tests\"]}}",
      "bad_example": "{\"name\": \"my-plugin\", \"interface\": {\"defaultPrompt\": [\"a\", \"b\", \"c\", \"d\"]}}"
    },
    {
      "id": "CDX-PL-009",
      "name": "Default Prompt Too Long",
      "severity": "MEDIUM",
      "category": "codex",
      "evidence": {
        "source_type": "vendor_code",
        "source_urls": [
          "https://github.com/openai/codex/blob/rust-v0.137.0/codex-rs/core-plugins/src/manifest.rs"
        ],
        "verified_on": "2026-06-04",
        "applies_to": {
          "tool": "codex",
          "version_range": ">=0.117.0"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\"name\": \"my-plugin\", \"interface\": {\"defaultPrompt\": [\"Fix the login bug\"]}}",
      "bad_example": "{\"name\": \"my-plugin\", \"interface\": {\"defaultPrompt\": [\"<500+ character prompt string>\"]}}"
    },
    {
      "id": "CDX-PL-010",
      "name": "Empty Default Prompt Entry",
      "severity": "MEDIUM",
      "category": "codex",
      "evidence": {
        "source_type": "vendor_code",
        "source_urls": [
          "https://github.com/openai/codex/blob/rust-v0.137.0/codex-rs/core-plugins/src/manifest.rs"
        ],
        "verified_on": "2026-06-04",
        "applies_to": {
          "tool": "codex",
          "version_range": ">=0.117.0"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\"name\": \"my-plugin\", \"interface\": {\"defaultPrompt\": [\"Fix the bug\", \"Add tests\"]}}",
      "bad_example": "{\"name\": \"my-plugin\", \"interface\": {\"defaultPrompt\": [\"Fix the bug\", \"\", \"Add tests\"]}}"
    },
    {
      "id": "CDX-PL-011",
      "name": "Invalid Interface URL",
      "severity": "MEDIUM",
      "category": "codex",
      "evidence": {
        "source_type": "vendor_code",
        "source_urls": [
          "https://github.com/openai/codex/blob/rust-v0.137.0/codex-rs/core-plugins/src/manifest.rs"
        ],
        "verified_on": "2026-06-04",
        "applies_to": {
          "tool": "codex",
          "version_range": ">=0.117.0"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\"name\": \"my-plugin\", \"interface\": {\"websiteUrl\": \"https://example.com\"}}",
      "bad_example": "{\"name\": \"my-plugin\", \"interface\": {\"websiteUrl\": \"not a url\"}}"
    },
    {
      "id": "CDX-PL-012",
      "name": "Invalid Asset Path",
      "severity": "MEDIUM",
      "category": "codex",
      "evidence": {
        "source_type": "vendor_code",
        "source_urls": [
          "https://github.com/openai/codex/blob/rust-v0.137.0/codex-rs/core-plugins/src/manifest.rs"
        ],
        "verified_on": "2026-06-04",
        "applies_to": {
          "tool": "codex",
          "version_range": ">=0.117.0"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\"name\": \"my-plugin\", \"interface\": {\"logo\": \"./assets/logo.png\"}}",
      "bad_example": "{\"name\": \"my-plugin\", \"interface\": {\"logo\": \"assets/logo.png\"}}"
    },
    {
      "id": "CDX-PL-013",
      "name": "Unsupported Hooks Field",
      "severity": "LOW",
      "category": "codex",
      "evidence": {
        "source_type": "vendor_code",
        "source_urls": [
          "https://github.com/openai/codex/blob/rust-v0.137.0/codex-rs/core-plugins/src/manifest.rs"
        ],
        "verified_on": "2026-06-04",
        "applies_to": {
          "tool": "codex",
          "version_range": ">=0.117.0"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\"name\": \"my-plugin\", \"skills\": \"./skills\"}",
      "bad_example": "{\"name\": \"my-plugin\", \"hooks\": {\"preStart\": \"echo hi\"}}"
    },
    {
      "id": "CDX-PL-014",
      "name": "Missing Description",
      "severity": "LOW",
      "category": "codex",
      "evidence": {
        "source_type": "vendor_code",
        "source_urls": [
          "https://github.com/openai/codex/blob/rust-v0.137.0/codex-rs/core-plugins/src/manifest.rs"
        ],
        "verified_on": "2026-06-04",
        "applies_to": {
          "tool": "codex",
          "version_range": ">=0.117.0"
        },
        "normative_level": "BEST_PRACTICE",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\"name\": \"my-plugin\", \"description\": \"Adds code review capabilities\"}",
      "bad_example": "{\"name\": \"my-plugin\"}"
    },
    {
      "id": "CDX-PL-015",
      "name": "Invalid Skills Path Type",
      "severity": "MEDIUM",
      "category": "codex",
      "evidence": {
        "source_type": "vendor_code",
        "source_urls": [
          "https://github.com/openai/codex/blob/rust-v0.137.0/codex-rs/core-plugins/src/manifest.rs"
        ],
        "verified_on": "2026-06-04",
        "applies_to": {
          "tool": "codex",
          "version_range": ">=0.137.0"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\"name\": \"my-plugin\", \"skills\": \"./skills\"}",
      "bad_example": "{\"name\": \"my-plugin\", \"skills\": [\"./skills\"]}"
    },
    {
      "id": "CDX-CFG-023",
      "name": "Invalid Approval Policy Sub-field",
      "severity": "MEDIUM",
      "category": "codex",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://developers.openai.com/codex/"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "codex"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": false,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe"
      },
      "good_example": "[approval_policy]\nmode = \"suggest\"",
      "bad_example": "[approval_policy]\nmode = \"yolo\""
    },
    {
      "id": "CDX-CFG-024",
      "name": "Invalid Approvals Reviewer Value",
      "severity": "MEDIUM",
      "category": "codex",
      "evidence": {
        "source_type": "vendor_code",
        "source_urls": [
          "https://github.com/openai/codex/blob/rust-v0.137.0/codex-rs/core/config.schema.json",
          "https://github.com/openai/codex/blob/rust-v0.140.0/codex-rs/core/config.schema.json"
        ],
        "verified_on": "2026-06-16",
        "applies_to": {
          "tool": "codex"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": false,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "unsafe"
      },
      "good_example": "approvals_reviewer = \"auto_review\"\n\n[apps.browser]\napprovals_reviewer = \"user\"\n\n[apps._default]\napprovals_reviewer = \"guardian_subagent\"",
      "bad_example": "approvals_reviewer = \"approve\"\n\n[apps.browser]\napprovals_reviewer = 42\n\n[apps._default]\napprovals_reviewer = \"approve\""
    },
    {
      "id": "CDX-CFG-025",
      "name": "Invalid Service Tier Value",
      "severity": "MEDIUM",
      "category": "codex",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://developers.openai.com/codex/"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "codex"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": false,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "unsafe"
      },
      "good_example": "service_tier = \"default\"",
      "bad_example": "service_tier = \"ultra\""
    },
    {
      "id": "CDX-CFG-026",
      "name": "Invalid Network Permission Field",
      "severity": "LOW",
      "category": "codex",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://developers.openai.com/codex/"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "codex"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": false,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe"
      },
      "good_example": "[network]\nallow = [\"*.example.com\"]",
      "bad_example": "[network]\nallow = \"all\""
    },
    {
      "id": "CDX-CFG-027",
      "name": "Invalid Windows Sandbox Value",
      "severity": "LOW",
      "category": "codex",
      "evidence": {
        "source_type": "vendor_code",
        "source_urls": [
          "https://github.com/openai/codex/blob/rust-v0.137.0/codex-rs/core/config.schema.json"
        ],
        "verified_on": "2026-06-04",
        "applies_to": {
          "tool": "codex"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": false,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "unsafe"
      },
      "good_example": "[windows]\nsandbox = \"elevated\"",
      "bad_example": "[windows]\nsandbox = \"docker\""
    },
    {
      "id": "CDX-CFG-028",
      "name": "Unsupported Inline MCP bearer_token Field",
      "severity": "HIGH",
      "category": "codex",
      "evidence": {
        "source_type": "vendor_code",
        "source_urls": [
          "https://github.com/openai/codex/pull/19294",
          "https://github.com/openai/codex/issues/19275"
        ],
        "verified_on": "2026-04-25",
        "applies_to": {
          "tool": "codex"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": false,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "[mcp_servers.myserver]\nurl = \"https://api.example.com\"\nbearer_token_env_var = \"MY_API_TOKEN\"",
      "bad_example": "[mcp_servers.myserver]\nurl = \"https://api.example.com\"\nbearer_token = \"sk-live-...\""
    },
    {
      "id": "CDX-CFG-029",
      "name": "Incompatible agents.max_threads with multi_agent_v2",
      "severity": "HIGH",
      "category": "codex",
      "evidence": {
        "source_type": "vendor_code",
        "source_urls": [
          "https://github.com/openai/codex/pull/19129",
          "https://github.com/openai/codex/pull/19733",
          "https://github.com/openai/codex/pull/19792",
          "https://github.com/openai/codex/blob/rust-v0.128.0/codex-rs/core/src/config/mod.rs"
        ],
        "verified_on": "2026-05-04",
        "applies_to": {
          "tool": "codex"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": false,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "[agents]\nmax_threads = 4\n\n[features]\n# multi_agent_v2 omitted or false",
      "bad_example": "[agents]\nmax_threads = 4\n\n[features]\nmulti_agent_v2 = true"
    },
    {
      "id": "CDX-REQ-000",
      "name": "Codex requirements.toml TOML Parse Error",
      "severity": "HIGH",
      "category": "codex",
      "evidence": {
        "source_type": "vendor_code",
        "source_urls": [
          "https://github.com/openai/codex/blob/rust-v0.137.0/codex-rs/config/src/config_requirements.rs",
          "https://github.com/openai/codex/blob/rust-v0.137.0/codex-rs/config/src/loader/mod.rs"
        ],
        "verified_on": "2026-06-04",
        "applies_to": {
          "tool": "codex",
          "version_range": ">=0.133.0"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": false,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "allow_managed_hooks_only = true",
      "bad_example": "allowed_sandbox_modes = [unclosed"
    },
    {
      "id": "CDX-REQ-001",
      "name": "Unknown Codex requirements.toml Key",
      "severity": "MEDIUM",
      "category": "codex",
      "evidence": {
        "source_type": "vendor_code",
        "source_urls": [
          "https://github.com/openai/codex/blob/rust-v0.137.0/codex-rs/config/src/config_requirements.rs",
          "https://github.com/openai/codex/blob/rust-v0.137.0/docs/config.md"
        ],
        "verified_on": "2026-06-04",
        "applies_to": {
          "tool": "codex",
          "version_range": ">=0.133.0"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": false,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "allowed_sandbox_modes = [\"read-only\"]\n[windows]\nallowed_sandbox_implementations = [\"elevated\", \"unelevated\"]",
      "bad_example": "allowed_sandbox_mode = [\"read-only\"]"
    },
    {
      "id": "CL-SK-001",
      "name": "Cline Skill Uses Unsupported Field",
      "severity": "MEDIUM",
      "category": "cline-skills",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://docs.cline.bot/prompting/cline-memory-bank#cline-memory-bank-custom-instructions-[copy-this]"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "cline"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe/unsafe"
      },
      "good_example": "---\nname: my-skill\ndescription: A useful development skill\n---\n# My Skill\n\nSkill instructions here.",
      "bad_example": "---\nname: my-skill\ndescription: A useful development skill\ncontext: fork\n---\n# My Skill\n\nSkill instructions here."
    },
    {
      "id": "CL-SK-002",
      "name": "Missing Skill Name",
      "severity": "HIGH",
      "category": "cline-skills",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://docs.cline.bot/features/cline-rules/overview"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "cline"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": false,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe"
      },
      "good_example": "---\nname: my-skill\ndescription: A skill\n---\n# My Skill",
      "bad_example": "---\ndescription: A skill\n---\n# My Skill"
    },
    {
      "id": "CL-SK-003",
      "name": "Missing Skill Description",
      "severity": "HIGH",
      "category": "cline-skills",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://docs.cline.bot/features/cline-rules/overview"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "cline"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": false,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "---\nname: my-skill\ndescription: A useful development skill\n---\n# My Skill",
      "bad_example": "---\nname: my-skill\n---\n# My Skill"
    },
    {
      "id": "CLN-001",
      "name": "Empty Cline Rules File",
      "severity": "HIGH",
      "category": "cline",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://docs.cline.bot/features/cline-rules/overview"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "cline"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "# Project Rules\n\nAlways follow the coding style guide and write tests for new features.",
      "bad_example": "   \n\n"
    },
    {
      "id": "CLN-002",
      "name": "Invalid Paths Glob in Cline Rules",
      "severity": "HIGH",
      "category": "cline",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://docs.cline.bot/features/cline-rules/overview"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "cline"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "---\npaths:\n  - \"**/*.ts\"\n---\n# TypeScript Rules\n\nUse strict mode.",
      "bad_example": "---\npaths:\n  - \"[unclosed\"\n---\n# TypeScript Rules\n\nUse strict mode."
    },
    {
      "id": "CLN-003",
      "name": "Unknown Frontmatter Key in Cline Rules",
      "severity": "MEDIUM",
      "category": "cline",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://docs.cline.bot/features/cline-rules/overview"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "cline"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "unsafe"
      },
      "good_example": "---\npaths:\n  - \"**/*.ts\"\n---\n# TypeScript Rules\n\nUse strict mode.",
      "bad_example": "---\npaths:\n  - \"**/*.ts\"\nunknownKey: some-value\n---\n# TypeScript Rules\n\nUse strict mode."
    },
    {
      "id": "CLN-004",
      "name": "Scalar Paths in Cline Rules",
      "severity": "HIGH",
      "category": "cline",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://docs.cline.bot/features/cline-rules"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "cline"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe"
      },
      "good_example": "---\npaths:\n  - \"**/*.ts\"\n---\n# TypeScript Rules\n\nUse strict mode.",
      "bad_example": "---\npaths: \"**/*.ts\"\n---\n# TypeScript Rules\n\nUse strict mode."
    },
    {
      "id": "CLN-005",
      "name": "Empty Workflow File",
      "severity": "HIGH",
      "category": "cline",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://docs.cline.bot/features/cline-rules/overview"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "cline"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": false,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "# Deploy Workflow\n\n1. Run tests\n2. Build\n3. Deploy",
      "bad_example": ""
    },
    {
      "id": "CLN-006",
      "name": "Workflow With Frontmatter",
      "severity": "MEDIUM",
      "category": "cline",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://docs.cline.bot/features/cline-rules/overview"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "cline"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": false,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "unsafe"
      },
      "good_example": "# Deploy Workflow\n\n1. Run tests\n2. Deploy",
      "bad_example": "---\nname: deploy\n---\n# Deploy Workflow\n\n1. Run tests\n2. Deploy"
    },
    {
      "id": "CLN-009",
      "name": "Unknown Hook Event Name",
      "severity": "MEDIUM",
      "category": "cline",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://docs.cline.bot/features/cline-rules/overview"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "cline"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": false,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"hooks\": { \"on_save\": [{ \"command\": \"npm test\" }] }\n}",
      "bad_example": "{\n  \"hooks\": { \"on_magic\": [{ \"command\": \"npm test\" }] }\n}"
    },
    {
      "id": "COP-001",
      "name": "Empty Copilot Instruction File",
      "severity": "HIGH",
      "category": "copilot",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://docs.github.com/en/copilot/reference/custom-instructions-support",
          "https://docs.github.com/en/copilot/how-tos/custom-instructions/adding-repository-custom-instructions-for-github-copilot",
          "https://github.blog/changelog/2025-08-28-copilot-coding-agent-now-supports-agents-md-custom-instructions/"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "github-copilot"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "# Copilot Instructions\n\nFollow the project coding standards and use TypeScript strict mode.",
      "bad_example": "   \n\n"
    },
    {
      "id": "COP-002",
      "name": "Invalid Frontmatter in Scoped Instructions",
      "severity": "HIGH",
      "category": "copilot",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://docs.github.com/en/copilot/how-tos/custom-instructions/adding-repository-custom-instructions-for-github-copilot",
          "https://docs.github.com/en/copilot/reference/custom-instructions-support"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "github-copilot"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "unsafe"
      },
      "good_example": "---\napplyTo: \"**/*.ts\"\n---\n# TypeScript Instructions\n\nUse strict mode and explicit types.",
      "bad_example": "# TypeScript Instructions\n\nUse strict mode and explicit types."
    },
    {
      "id": "COP-003",
      "name": "Invalid Glob Pattern in applyTo",
      "severity": "HIGH",
      "category": "copilot",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://docs.github.com/en/copilot/how-tos/custom-instructions/adding-repository-custom-instructions-for-github-copilot",
          "https://docs.github.com/en/copilot/reference/custom-instructions-support"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "github-copilot"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "---\napplyTo: \"**/*.ts\"\n---\n# TypeScript Instructions\n\nUse strict mode.",
      "bad_example": "---\napplyTo: \"[unclosed\"\n---\n# TypeScript Instructions\n\nUse strict mode."
    },
    {
      "id": "COP-004",
      "name": "Unknown Frontmatter Keys",
      "severity": "MEDIUM",
      "category": "copilot",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://docs.github.com/en/copilot/how-tos/custom-instructions/adding-repository-custom-instructions-for-github-copilot",
          "https://docs.github.com/en/copilot/reference/custom-instructions-support"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "github-copilot"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe"
      },
      "good_example": "---\napplyTo: \"**/*.ts\"\n---\n# TypeScript Instructions\n\nUse strict mode.",
      "bad_example": "---\napplyTo: \"**/*.ts\"\nunknownKey: some-value\n---\n# TypeScript Instructions\n\nUse strict mode."
    },
    {
      "id": "COP-005",
      "name": "Invalid excludeAgent Value",
      "severity": "HIGH",
      "category": "copilot",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://docs.github.com/en/copilot/how-tos/custom-instructions/adding-repository-custom-instructions-for-github-copilot",
          "https://docs.github.com/en/copilot/reference/custom-instructions-support"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "github-copilot"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "unsafe"
      },
      "good_example": "---\napplyTo: \"**/*.ts\"\nexcludeAgent: \"code-review\"\n---\n# TypeScript Instructions\n\nUse strict mode.",
      "bad_example": "---\napplyTo: \"**/*.ts\"\nexcludeAgent: \"invalid-agent\"\n---\n# TypeScript Instructions\n\nUse strict mode."
    },
    {
      "id": "COP-006",
      "name": "File Length Limit",
      "severity": "MEDIUM",
      "category": "copilot",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://docs.github.com/en/copilot/how-tos/custom-instructions/adding-repository-custom-instructions-for-github-copilot",
          "https://docs.github.com/en/copilot/reference/custom-instructions-support"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "github-copilot"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "# Copilot Instructions\n\nKeep instructions concise and focused on key coding standards.",
      "bad_example": "# Copilot Instructions\n\nThis file contains overly detailed coding guidelines.\n\nFollow consistent naming conventions for variables and functions. Use descriptive names that clearly convey purpose.\nFollow consistent naming conventions for variables and functions. Use descriptive names that clearly convey purpose.\nFollow consistent naming conventions for variables and functions. Use descriptive names that clearly convey purpose.\nFollow consistent naming conventions for variables and functions. Use descriptive names that clearly convey purpose.\nFollow consistent naming conventions for variables and functions. Use descriptive names that clearly convey purpose.\nFollow consistent naming conventions for variables and functions. Use descriptive names that clearly convey purpose.\nFollow consistent naming conventions for variables and functions. Use descriptive names that clearly convey purpose.\nFollow consistent naming conventions for variables and functions. Use descriptive names that clearly convey purpose.\nFollow consistent naming conventions for variables and functions. Use descriptive names that clearly convey purpose.\nFollow consistent naming conventions for variables and functions. Use descriptive names that clearly convey purpose.\nFollow consistent naming conventions for variables and functions. Use descriptive names that clearly convey purpose.\nFollow consistent naming conventions for variables and functions. Use descriptive names that clearly convey purpose.\nFollow consistent naming conventions for variables and functions. Use descriptive names that clearly convey purpose.\nFollow consistent naming conventions for variables and functions. Use descriptive names that clearly convey purpose.\nFollow consistent naming conventions for variables and functions. Use descriptive names that clearly convey purpose.\nFollow consistent naming conventions for variables and functions. Use descriptive names that clearly convey purpose.\nFollow consistent naming conventions for variables and functions. Use descriptive names that clearly convey purpose.\nFollow consistent naming conventions for variables and functions. Use descriptive names that clearly convey purpose.\nFollow consistent naming conventions for variables and functions. Use descriptive names that clearly convey purpose.\nFollow consistent naming conventions for variables and functions. Use descriptive names that clearly convey purpose.\nFollow consistent naming conventions for variables and functions. Use descriptive names that clearly convey purpose.\nFollow consistent naming conventions for variables and functions. Use descriptive names that clearly convey purpose.\nFollow consistent naming conventions for variables and functions. Use descriptive names that clearly convey purpose.\nFollow consistent naming conventions for variables and functions. Use descriptive names that clearly convey purpose.\nFollow consistent naming conventions for variables and functions. Use descriptive names that clearly convey purpose.\nFollow consistent naming conventions for variables and functions. Use descriptive names that clearly convey purpose.\nFollow consistent naming conventions for variables and functions. Use descriptive names that clearly convey purpose.\nFollow consistent naming conventions for variables and functions. Use descriptive names that clearly convey purpose.\nFollow consistent naming conventions for variables and functions. Use descriptive names that clearly convey purpose.\nFollow consistent naming conventions for variables and functions. Use descriptive names that clearly convey purpose.\nFollow consistent naming conventions for variables and functions. Use descriptive names that clearly convey purpose.\nFollow consistent naming conventions for variables and functions. Use descriptive names that clearly convey purpose.\nFollow consistent naming conventions for variables and functions. Use descriptive names that clearly convey purpose.\nFollow consistent naming conventions for variables and functions. Use descriptive names that clearly convey purpose.\nFollow consistent naming conventions for variables and functions. Use descriptive names that clearly convey purpose.\n"
    },
    {
      "id": "COP-007",
      "name": "Custom Agent Missing Description",
      "severity": "HIGH",
      "category": "copilot",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://docs.github.com/en/copilot/reference/custom-agents-configuration"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "github-copilot"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "---\ndescription: Review pull requests for quality and safety\n---\nReview pull requests and suggest focused improvements.",
      "bad_example": "---\ntarget: vscode\n---\nReview pull requests."
    },
    {
      "id": "COP-008",
      "name": "Custom Agent Unknown or Invalid Frontmatter Field",
      "severity": "MEDIUM",
      "category": "copilot",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://docs.github.com/en/copilot/reference/custom-agents-configuration"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "github-copilot"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe"
      },
      "good_example": "---\nname: reviewer\ndescription: Review pull requests\nuser-invocable: true\nmetadata:\n  owner: security\n---\nReview pull requests.",
      "bad_example": "---\ndescription: Review pull requests\nuser-invocable: \"yes\"\nunknown-field: true\n---\nReview pull requests."
    },
    {
      "id": "COP-009",
      "name": "Custom Agent Invalid Target",
      "severity": "HIGH",
      "category": "copilot",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://docs.github.com/en/copilot/reference/custom-agents-configuration"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "github-copilot"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "unsafe"
      },
      "good_example": "---\ndescription: Review pull requests\ntarget: vscode\n---\nReview pull requests.",
      "bad_example": "---\ndescription: Review pull requests\ntarget: desktop\n---\nReview pull requests."
    },
    {
      "id": "COP-010",
      "name": "Custom Agent infer Field Must Be Boolean",
      "severity": "MEDIUM",
      "category": "copilot",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://docs.github.com/en/copilot/reference/custom-agents-configuration"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "github-copilot"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "---\ndescription: Review pull requests\ninfer: true\n---\nReview pull requests.",
      "bad_example": "---\ndescription: Review pull requests\ninfer: \"auto\"\n---\nReview pull requests."
    },
    {
      "id": "COP-011",
      "name": "Custom Agent Prompt Body Exceeds Length Limit",
      "severity": "HIGH",
      "category": "copilot",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://docs.github.com/en/copilot/reference/custom-agents-configuration"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "github-copilot"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "---\ndescription: Review pull requests\n---\nUse concise, focused instructions.",
      "bad_example": "---\ndescription: Large prompt\n---\[encoded data, 30002 characters]"
    },
    {
      "id": "COP-012",
      "name": "Custom Agent Uses GitHub.com Unsupported Fields",
      "severity": "MEDIUM",
      "category": "copilot",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://docs.github.com/en/copilot/reference/custom-agents-configuration"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "github-copilot"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe"
      },
      "good_example": "---\ndescription: Review pull requests\n---\nReview pull requests.",
      "bad_example": "---\ndescription: Review pull requests\nmodel: gpt-4.1\nargument-hint: branch-name\n---\nReview pull requests."
    },
    {
      "id": "COP-013",
      "name": "Prompt File Empty Body",
      "severity": "HIGH",
      "category": "copilot",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.visualstudio.com/docs/copilot/customization/prompt-files",
          "https://docs.github.com/en/copilot/reference/custom-instructions-support"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "github-copilot"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "---\ndescription: Refactor selected code\n---\nRefactor the selected code while preserving behavior.",
      "bad_example": "---\ndescription: Refactor selected code\n---\n"
    },
    {
      "id": "COP-014",
      "name": "Prompt File Unknown Frontmatter Field",
      "severity": "MEDIUM",
      "category": "copilot",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.visualstudio.com/docs/copilot/customization/prompt-files",
          "https://docs.github.com/en/copilot/reference/custom-instructions-support"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "github-copilot"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe"
      },
      "good_example": "---\ndescription: Refactor selected code\nagent: ask\n---\nRefactor the selected code.",
      "bad_example": "---\ndescription: Refactor selected code\nunknown-option: true\n---\nRefactor the selected code."
    },
    {
      "id": "COP-015",
      "name": "Prompt File Invalid Agent Mode",
      "severity": "HIGH",
      "category": "copilot",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://code.visualstudio.com/docs/copilot/customization/prompt-files",
          "https://docs.github.com/en/copilot/reference/custom-instructions-support"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "github-copilot"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe"
      },
      "good_example": "---\ndescription: Refactor selected code\nagent: ask\n---\nRefactor the selected code.",
      "bad_example": "---\ndescription: Refactor selected code\nagent: maybe\n---\nRefactor the selected code."
    },
    {
      "id": "COP-017",
      "name": "Copilot Hooks Schema Validation",
      "severity": "HIGH",
      "category": "copilot",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://docs.github.com/en/copilot/concepts/agents/coding-agent/about-hooks"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "github-copilot"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\"version\":1,\"hooks\":[{\"type\":\"command\",\"events\":[\"sessionStart\"],\"command\":{\"bash\":\"echo start\"}}]}",
      "bad_example": "{\"version\":1,\"hooks\":[{\"events\":[\"sessionStart\"],\"command\":{\"bash\":\"echo start\"}}]}"
    },
    {
      "id": "COP-018",
      "name": "Invalid copilot-setup-steps Job",
      "severity": "HIGH",
      "category": "copilot",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://docs.github.com/en/copilot/how-tos/agents/copilot-coding-agent/customizing-the-development-environment-for-copilot-coding-agent"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "github-copilot"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "jobs:\n  copilot-setup-steps:\n    runs-on: ubuntu-latest\n    steps:\n      - run: echo setup",
      "bad_example": "jobs:\n  setup:\n    runs-on: ubuntu-latest\n    steps:\n      - run: echo setup"
    },
    {
      "id": "COP-019",
      "name": "Plugin Missing Required Fields",
      "severity": "HIGH",
      "category": "copilot",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://docs.github.com/en/copilot/customizing-copilot"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "github-copilot"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": false,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"name\": \"my-plugin\",\n  \"version\": \"1.0.0\",\n  \"description\": \"A plugin\"\n}",
      "bad_example": "{\n  \"name\": \"my-plugin\"\n}"
    },
    {
      "id": "COP-020",
      "name": "Plugin Invalid Field Types",
      "severity": "MEDIUM",
      "category": "copilot",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://docs.github.com/en/copilot/customizing-copilot"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "github-copilot"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": false,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"name\": \"my-plugin\",\n  \"version\": \"1.0.0\",\n  \"enabled\": true\n}",
      "bad_example": "{\n  \"name\": \"my-plugin\",\n  \"version\": 1,\n  \"enabled\": \"yes\"\n}"
    },
    {
      "id": "COP-022",
      "name": "CLI Skill Missing Frontmatter",
      "severity": "HIGH",
      "category": "copilot",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://docs.github.com/en/copilot/customizing-copilot"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "github-copilot"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": false,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "---\nname: my-skill\ndescription: Skill for linting\n---\n# My Skill\nInstructions.",
      "bad_example": "# My Skill\nInstructions without frontmatter."
    },
    {
      "id": "COP-023",
      "name": "CLI Skill Name Format",
      "severity": "MEDIUM",
      "category": "copilot",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://docs.github.com/en/copilot/customizing-copilot"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "github-copilot"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": false,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe"
      },
      "good_example": "---\nname: lint-config\ndescription: Lint config files\n---",
      "bad_example": "---\nname: Lint Config!!\ndescription: Lint config files\n---"
    },
    {
      "id": "COP-024",
      "name": "CLI Skill Unknown Field",
      "severity": "MEDIUM",
      "category": "copilot",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://docs.github.com/en/copilot/customizing-copilot"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "github-copilot"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": false,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe"
      },
      "good_example": "---\nname: my-skill\ndescription: A useful skill\n---",
      "bad_example": "---\nname: my-skill\ndescription: A useful skill\npriority: high\n---"
    },
    {
      "id": "COP-025",
      "name": "Agent File Wrong Location",
      "severity": "LOW",
      "category": "copilot",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://docs.github.com/en/copilot/customizing-copilot"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "github-copilot"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": false,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": ".github/copilot-instructions.md",
      "bad_example": "copilot-instructions.md"
    },
    {
      "id": "COP-026",
      "name": "Deprecated SSE Transport",
      "severity": "LOW",
      "category": "copilot",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://docs.github.com/en/copilot/customizing-copilot"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "github-copilot"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": false,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "unsafe"
      },
      "good_example": "{\n  \"transport\": \"streamable-http\"\n}",
      "bad_example": "{\n  \"transport\": \"sse\"\n}"
    },
    {
      "id": "COP-027",
      "name": "Deprecated Infer Field",
      "severity": "LOW",
      "category": "copilot",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://docs.github.com/en/copilot/customizing-copilot"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "github-copilot"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": false,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"name\": \"my-plugin\",\n  \"version\": \"1.0.0\"\n}",
      "bad_example": "{\n  \"name\": \"my-plugin\",\n  \"infer\": true\n}"
    },
    {
      "id": "CP-SK-001",
      "name": "Copilot Skill Uses Unsupported Field",
      "severity": "MEDIUM",
      "category": "copilot-skills",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://docs.github.com/en/copilot/customizing-copilot/adding-repository-custom-instructions-for-github-copilot"
        ],
        "verified_on": "2026-02-07",
        "applies_to": {
          "tool": "github-copilot"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe/unsafe"
      },
      "good_example": "---\nname: my-skill\ndescription: A useful development skill\n---\n# My Skill\n\nSkill instructions here.",
      "bad_example": "---\nname: my-skill\ndescription: A useful development skill\nagent: general-purpose\n---\n# My Skill\n\nSkill instructions here."
    },
    {
      "id": "CR-SK-001",
      "name": "Cursor Skill Uses Unsupported Field",
      "severity": "MEDIUM",
      "category": "cursor-skills",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://cursor.com/docs/context/skills"
        ],
        "verified_on": "2026-02-07",
        "applies_to": {
          "tool": "cursor"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe/unsafe"
      },
      "good_example": "---\nname: my-skill\ndescription: A useful development skill\ndisable-model-invocation: true\n---\n# My Skill\n\nSkill instructions here.",
      "bad_example": "---\nname: my-skill\ndescription: A useful development skill\nmodel: opus\n---\n# My Skill\n\nSkill instructions here."
    },
    {
      "id": "CUR-001",
      "name": "Empty Cursor Rule File",
      "severity": "HIGH",
      "category": "cursor",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://cursor.com/docs/rules"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "cursor"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "---\ndescription: TypeScript coding rules\nglobs: \"**/*.ts\"\n---\n# TypeScript Rules\n\nUse strict mode and explicit types.",
      "bad_example": "---\ndescription: \n---\n"
    },
    {
      "id": "CUR-002",
      "name": "Missing Frontmatter in .mdc File",
      "severity": "MEDIUM",
      "category": "cursor",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://cursor.com/docs/rules"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "cursor"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "unsafe"
      },
      "good_example": "---\ndescription: TypeScript rules\nglobs: \"**/*.ts\"\n---\n# TypeScript Rules\n\nUse strict mode.",
      "bad_example": "# TypeScript Rules\n\nUse strict mode and explicit types."
    },
    {
      "id": "CUR-003",
      "name": "Invalid YAML Frontmatter",
      "severity": "HIGH",
      "category": "cursor",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://cursor.com/docs/rules"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "cursor"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "---\ndescription: TypeScript rules\nglobs: \"**/*.ts\"\n---\n# Rules\n\nUse strict mode.",
      "bad_example": "---\nglobs: [unclosed\n---\n# Rules\n\nUse strict mode."
    },
    {
      "id": "CUR-004",
      "name": "Invalid Glob Pattern in globs Field",
      "severity": "HIGH",
      "category": "cursor",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://cursor.com/docs/rules"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "cursor"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "---\ndescription: TypeScript rules\nglobs: \"**/*.ts\"\n---\n# Rules\n\nUse strict mode.",
      "bad_example": "---\ndescription: TypeScript rules\nglobs: \"[unclosed\"\n---\n# Rules\n\nUse strict mode."
    },
    {
      "id": "CUR-005",
      "name": "Unknown Frontmatter Keys",
      "severity": "MEDIUM",
      "category": "cursor",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://cursor.com/docs/rules"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "cursor"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe"
      },
      "good_example": "---\ndescription: TypeScript rules\nglobs: \"**/*.ts\"\nalwaysApply: false\n---\n# Rules\n\nUse strict mode.",
      "bad_example": "---\ndescription: TypeScript rules\nunknownKey: some-value\n---\n# Rules\n\nUse strict mode."
    },
    {
      "id": "CUR-006",
      "name": "Legacy .cursorrules File Detected",
      "severity": "MEDIUM",
      "category": "cursor",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://cursor.com/docs/rules"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "cursor"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "---\ndescription: TypeScript rules\nglobs: \"**/*.ts\"\n---\n# TypeScript Rules\n\nUse strict mode.",
      "bad_example": "# Legacy cursor rules\n\nUse strict mode and explicit types."
    },
    {
      "id": "CUR-007",
      "name": "alwaysApply with Redundant globs",
      "severity": "MEDIUM",
      "category": "cursor",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://cursor.com/docs/rules"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "cursor"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe"
      },
      "good_example": "---\ndescription: Global rules\nalwaysApply: true\n---\n# Rules\n\nAlways apply these rules.",
      "bad_example": "---\ndescription: TypeScript rules\nalwaysApply: true\nglobs: \"**/*.ts\"\n---\n# Rules\n\nUse strict mode."
    },
    {
      "id": "CUR-008",
      "name": "Invalid alwaysApply Type",
      "severity": "HIGH",
      "category": "cursor",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://cursor.com/docs/rules"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "cursor"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe"
      },
      "good_example": "---\ndescription: TypeScript rules\nalwaysApply: true\n---\n# Rules\n\nAlways use strict mode.",
      "bad_example": "---\ndescription: TypeScript rules\nalwaysApply: \"true\"\n---\n# Rules\n\nAlways use strict mode."
    },
    {
      "id": "CUR-009",
      "name": "Missing Description for Agent-Requested Rule",
      "severity": "MEDIUM",
      "category": "cursor",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://cursor.com/docs/rules"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "cursor"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "---\ndescription: TypeScript coding standards and best practices\n---\n# Rules\n\nUse strict mode.",
      "bad_example": "---\n\n---\n# Rules\n\nUse strict mode and explicit types."
    },
    {
      "id": "CUR-010",
      "name": "Invalid Cursor Hooks Schema",
      "severity": "HIGH",
      "category": "cursor",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://cursor.com/docs/hooks"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "cursor"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\"version\":1,\"hooks\":{\"sessionStart\":[{\"type\":\"command\",\"command\":\"echo start\"}]}}",
      "bad_example": "{\"hooks\":{}}"
    },
    {
      "id": "CUR-011",
      "name": "Unknown Cursor Hook Event Name",
      "severity": "MEDIUM",
      "category": "cursor",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://cursor.com/docs/hooks"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "cursor"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe"
      },
      "good_example": "{\"version\":1,\"hooks\":{\"sessionStart\":[{\"type\":\"command\",\"command\":\"echo start\"}]}}",
      "bad_example": "{\"version\":1,\"hooks\":{\"unknownEvent\":[{\"type\":\"command\",\"command\":\"echo start\"}]}}"
    },
    {
      "id": "CUR-012",
      "name": "Hook Entry Missing Required Command Field",
      "severity": "HIGH",
      "category": "cursor",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://cursor.com/docs/hooks"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "cursor"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\"version\":1,\"hooks\":{\"sessionStart\":[{\"type\":\"command\",\"command\":\"echo start\"}]}}",
      "bad_example": "{\"version\":1,\"hooks\":{\"sessionStart\":[{\"type\":\"command\"}]}}"
    },
    {
      "id": "CUR-013",
      "name": "Invalid Cursor Hook Type Value",
      "severity": "HIGH",
      "category": "cursor",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://cursor.com/docs/hooks"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "cursor"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe"
      },
      "good_example": "{\"version\":1,\"hooks\":{\"sessionStart\":[{\"type\":\"prompt\",\"command\":\"Summarize changes\"}]}}",
      "bad_example": "{\"version\":1,\"hooks\":{\"sessionStart\":[{\"type\":\"agent\",\"command\":\"echo start\"}]}}"
    },
    {
      "id": "CUR-014",
      "name": "Invalid Cursor Subagent Frontmatter",
      "severity": "HIGH",
      "category": "cursor",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://cursor.com/docs/subagents"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "cursor"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "---\nname: reviewer-agent\ndescription: Reviews code for defects\nmodel: fast\nreadonly: true\nis_background: false\n---\nReview staged changes and prioritize findings.",
      "bad_example": "---\nname: ReviewerAgent\ndescription: 123\nreadonly: \"true\"\n---\nReview staged changes."
    },
    {
      "id": "CUR-015",
      "name": "Empty Cursor Subagent Body",
      "severity": "MEDIUM",
      "category": "cursor",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://cursor.com/docs/subagents"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "cursor"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "---\nname: reviewer-agent\ndescription: Reviews code for defects\n---\nReview the diff and return a concise risk report.",
      "bad_example": "---\nname: reviewer-agent\ndescription: Reviews code for defects\n---\n"
    },
    {
      "id": "CUR-016",
      "name": "Invalid Cursor Environment Schema",
      "severity": "HIGH",
      "category": "cursor",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://cursor.com/docs/cloud-agent/setup"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "cursor"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\"build\":{\"dockerfile\":\"Dockerfile\",\"context\":\"..\"},\"install\":\"npm ci\",\"start\":\"npm run dev\",\"terminals\":[{\"name\":\"app\",\"command\":\"npm run dev\"}]}",
      "bad_example": "{\"install\":42,\"terminals\":[{\"name\":\"app\"}]}"
    },
    {
      "id": "CUR-017",
      "name": "Invalid Hook Entry Field Types",
      "severity": "MEDIUM",
      "category": "cursor",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://cursor.com/docs/hooks"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "cursor",
          "file_types": [
            "cursor-hooks"
          ]
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": false,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"hooks\": {\n    \"save-file\": [{ \"command\": \"npm run lint\", \"events\": [\"file_saved\"] }]\n  }\n}",
      "bad_example": "{\n  \"hooks\": {\n    \"save-file\": [{ \"command\": 42, \"events\": \"file_saved\" }]\n  }\n}"
    },
    {
      "id": "CUR-018",
      "name": "Prompt Hook Missing Prompt Field",
      "severity": "MEDIUM",
      "category": "cursor",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://cursor.com/docs/hooks"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "cursor",
          "file_types": [
            "cursor-hooks"
          ]
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": false,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"hooks\": {\n    \"ai-review\": [{ \"type\": \"prompt\", \"prompt\": \"Review this change\" }]\n  }\n}",
      "bad_example": "{\n  \"hooks\": {\n    \"ai-review\": [{ \"type\": \"prompt\" }]\n  }\n}"
    },
    {
      "id": "CUR-019",
      "name": "Invalid Prompt Hook Model Type",
      "severity": "LOW",
      "category": "cursor",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://cursor.com/docs/hooks"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "cursor",
          "file_types": [
            "cursor-hooks"
          ]
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": false,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"hooks\": {\n    \"ai-review\": [{ \"type\": \"prompt\", \"prompt\": \"Review\", \"model\": \"gpt-4\" }]\n  }\n}",
      "bad_example": "{\n  \"hooks\": {\n    \"ai-review\": [{ \"type\": \"prompt\", \"prompt\": \"Review\", \"model\": 123 }]\n  }\n}"
    },
    {
      "id": "CX-SK-001",
      "name": "Codex Skill Uses Unsupported Field",
      "severity": "MEDIUM",
      "category": "codex-skills",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://developers.openai.com/codex/guides/agents-md"
        ],
        "verified_on": "2026-02-07",
        "applies_to": {
          "tool": "codex"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe/unsafe"
      },
      "good_example": "---\nname: my-skill\ndescription: A useful development skill\n---\n# My Skill\n\nSkill instructions here.",
      "bad_example": "---\nname: my-skill\ndescription: A useful development skill\nhooks: some-value\n---\n# My Skill\n\nSkill instructions here."
    },
    {
      "id": "GM-001",
      "name": "Invalid Markdown Structure in GEMINI.md",
      "severity": "HIGH",
      "category": "gemini-cli",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://geminicli.com/docs/cli/gemini-md/"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "gemini-cli"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe"
      },
      "good_example": "# Project\n\nThis is a web application.\n\n```bash\nnpm install\n```\n\n## Testing\n\nRun npm test.",
      "bad_example": "# Project\n\nThis is a web application.\n\n```bash\nnpm install"
    },
    {
      "id": "GM-002",
      "name": "Missing Section Headers in GEMINI.md",
      "severity": "MEDIUM",
      "category": "gemini-cli",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://geminicli.com/docs/cli/gemini-md/"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "gemini-cli"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "# My Project\n\nA web application built with TypeScript.\n\n## Build\n\nRun npm build.",
      "bad_example": "Just plain text instructions without any section headers or structure."
    },
    {
      "id": "GM-003",
      "name": "Missing Project Context in GEMINI.md",
      "severity": "MEDIUM",
      "category": "gemini-cli",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://geminicli.com/docs/cli/gemini-md/"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "gemini-cli"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "# Project\n\nThis is a linter for agent configurations.\n\n## Build\n\nRun cargo build.",
      "bad_example": "# Build Commands\n\nRun npm install and npm build.\n\n## Testing\n\nUse npm test."
    },
    {
      "id": "GM-004",
      "name": "Invalid Hooks Configuration in Gemini Settings",
      "severity": "MEDIUM",
      "category": "gemini-cli",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://geminicli.com/docs/hooks"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "gemini-cli"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\"hooksConfig\":{\"BeforeAgent\":[{\"type\":\"command\",\"command\":\"echo test\"}]}}",
      "bad_example": "{\"hooksConfig\":{\"InvalidEvent\":[{\"type\":\"command\",\"command\":\"echo test\"}]}}"
    },
    {
      "id": "GM-005",
      "name": "Invalid Extension Manifest",
      "severity": "HIGH",
      "category": "gemini-cli",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://geminicli.com/docs/extensions/reference"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "gemini-cli"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\"name\":\"my-extension\",\"version\":\"1.0.0\",\"description\":\"A useful extension\"}",
      "bad_example": "{\"version\":\"1.0.0\"}"
    },
    {
      "id": "GM-006",
      "name": "Invalid .geminiignore File",
      "severity": "LOW",
      "category": "gemini-cli",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://geminicli.com/docs/cli/settings"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "gemini-cli"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "node_modules/\n*.log\n.env",
      "bad_example": ""
    },
    {
      "id": "GM-007",
      "name": "@import File Not Found in GEMINI.md",
      "severity": "MEDIUM",
      "category": "gemini-cli",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://geminicli.com/docs/cli/gemini-md/"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "gemini-cli"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "@import shared-rules.md",
      "bad_example": "@import nonexistent-file.md"
    },
    {
      "id": "GM-008",
      "name": "Invalid Context File Name Configuration",
      "severity": "LOW",
      "category": "gemini-cli",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://geminicli.com/docs/extensions/reference"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "gemini-cli"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe"
      },
      "good_example": "{\"contextFileName\":\"CONTEXT.md\"}",
      "bad_example": "{\"contextFileName\":\"docs/context.md\"}"
    },
    {
      "id": "GM-009",
      "name": "Settings.json Parse Error",
      "severity": "HIGH",
      "category": "gemini-cli",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://geminicli.com/docs/cli/settings"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "gemini-cli"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe"
      },
      "good_example": "{\"general\":{},\"model\":{}}",
      "bad_example": "{ invalid json }"
    },
    {
      "id": "GM-010",
      "name": "memoryManager Without autoMemory After v0.40 Split",
      "severity": "MEDIUM",
      "category": "gemini-cli",
      "evidence": {
        "source_type": "vendor_code",
        "source_urls": [
          "https://github.com/google-gemini/gemini-cli/pull/25601",
          "https://github.com/google-gemini/gemini-cli/blob/v0.40.0/packages/cli/src/config/settingsSchema.ts",
          "https://github.com/google-gemini/gemini-cli/blob/v0.40.0/docs/cli/auto-memory.md"
        ],
        "verified_on": "2026-04-29",
        "applies_to": {
          "tool": "gemini-cli",
          "version_range": ">=0.40.0"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": false,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\"experimental\":{\"memoryManager\":true,\"autoMemory\":true}}",
      "bad_example": "{\"experimental\":{\"memoryManager\":true}}"
    },
    {
      "id": "GM-AG-001",
      "name": "Invalid auth block in Gemini agent MCP server",
      "severity": "HIGH",
      "category": "gemini-agents",
      "evidence": {
        "source_type": "vendor_code",
        "source_urls": [
          "https://github.com/google-gemini/gemini-cli/pull/24770"
        ],
        "verified_on": "2026-04-26",
        "applies_to": {
          "tool": "gemini-cli"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "---\nkind: local\nname: spanner-agent\nmcp_servers:\n  spanner:\n    url: https://spanner.googleapis.com/mcp\n    type: http\n    auth:\n      type: google-credentials\n      scopes:\n        - https://www.googleapis.com/auth/cloud-platform\nsystem_prompt: Example\n---\n",
      "bad_example": "---\nkind: local\nname: spanner-agent\nmcp_servers:\n  spanner:\n    auth:\n      type: basic-auth\nsystem_prompt: Example\n---\n"
    },
    {
      "id": "KIRO-001",
      "name": "Invalid Steering File Inclusion Mode",
      "severity": "HIGH",
      "category": "kiro-steering",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://kiro.dev/docs/steering/"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "kiro"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe"
      },
      "good_example": "---\ninclusion: always\n---\n# TypeScript Guidelines\n\nUse strict mode.",
      "bad_example": "---\ninclusion: invalid_mode\n---\n# TypeScript Guidelines\n\nUse strict mode."
    },
    {
      "id": "KIRO-002",
      "name": "Missing Required Fields for Inclusion Mode",
      "severity": "HIGH",
      "category": "kiro-steering",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://kiro.dev/docs/steering/"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "kiro"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "---\ninclusion: auto\nname: typescript-guidelines\ndescription: Guidelines for TypeScript development\n---\n# TypeScript Guidelines",
      "bad_example": "---\ninclusion: auto\n---\n# TypeScript Guidelines"
    },
    {
      "id": "KIRO-003",
      "name": "Invalid fileMatchPattern Glob",
      "severity": "MEDIUM",
      "category": "kiro-steering",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://kiro.dev/docs/steering/"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "kiro"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "---\ninclusion: fileMatch\nfileMatchPattern: \"**/*.ts\"\n---\n# TypeScript Guidelines",
      "bad_example": "---\ninclusion: fileMatch\nfileMatchPattern: \"[unclosed\"\n---\n# TypeScript Guidelines"
    },
    {
      "id": "KIRO-004",
      "name": "Empty Kiro Steering File",
      "severity": "MEDIUM",
      "category": "kiro-steering",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://kiro.dev/docs/steering/"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "kiro"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "---\ninclusion: always\n---\n# TypeScript Guidelines\n\nUse strict mode.",
      "bad_example": ""
    },
    {
      "id": "KIRO-005",
      "name": "Empty Steering Body After Frontmatter",
      "severity": "MEDIUM",
      "category": "kiro-steering",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://kiro.dev/docs/steering/"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "kiro"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "---\ninclusion: always\n---\n# Team Standards\n\nExplain reasoning and include concrete examples.",
      "bad_example": "---\ninclusion: always\n---\n"
    },
    {
      "id": "KIRO-006",
      "name": "Secrets Detected in Steering File",
      "severity": "HIGH",
      "category": "kiro-steering",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://kiro.dev/docs/steering/"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "kiro"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "---\ninclusion: always\n---\nUse ${API_KEY} from the environment at runtime.",
      "bad_example": "---\ninclusion: always\n---\nAPI_KEY=hardcoded-secret-123"
    },
    {
      "id": "KIRO-007",
      "name": "fileMatchPattern Without fileMatch Inclusion",
      "severity": "MEDIUM",
      "category": "kiro-steering",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://kiro.dev/docs/steering/"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "kiro"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "---\ninclusion: fileMatch\nfileMatchPattern: \"**/*.ts\"\n---\nTypeScript guidance.",
      "bad_example": "---\ninclusion: always\nfileMatchPattern: \"**/*.ts\"\n---\nThis pattern is never applied."
    },
    {
      "id": "KIRO-008",
      "name": "Unknown Kiro Steering Frontmatter Field",
      "severity": "MEDIUM",
      "category": "kiro-steering",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://kiro.dev/docs/steering/"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "kiro"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "---\ninclusion: auto\nname: coding-style\ndescription: Team coding standards\n---\nFollow conventions.",
      "bad_example": "---\ninclusions: always\n---\nTypo in frontmatter key."
    },
    {
      "id": "KIRO-009",
      "name": "Broken Inline File Reference in Steering",
      "severity": "MEDIUM",
      "category": "kiro-steering",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://kiro.dev/docs/steering/"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "kiro"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "Read #[[file:docs/style-guide.md]] before generating code.",
      "bad_example": "Read #[[file:docs/missing-style-guide.md]] before generating code."
    },
    {
      "id": "KIRO-010",
      "name": "Missing Inclusion Mode",
      "severity": "MEDIUM",
      "category": "kiro-steering",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://kiro.dev/docs/steering"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "kiro"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "---\ninclusion: always\n---\n# Steering",
      "bad_example": "---\nname: test\n---\n# Steering"
    },
    {
      "id": "KIRO-011",
      "name": "Steering Doc Excessively Long",
      "severity": "LOW",
      "category": "kiro-steering",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://kiro.dev/docs/steering"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "kiro"
        },
        "normative_level": "BEST_PRACTICE",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "---\ninclusion: always\n---\n# Concise guidance",
      "bad_example": "---\ninclusion: always\n---\n# Very long doc..."
    },
    {
      "id": "KIRO-012",
      "name": "Duplicate Steering Name",
      "severity": "MEDIUM",
      "category": "kiro-steering",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://kiro.dev/docs/steering"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "kiro"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "---\ninclusion: auto\nname: unique-name\ndescription: desc\n---\n# Content",
      "bad_example": "# Two steering files with name: duplicate-name"
    },
    {
      "id": "KIRO-013",
      "name": "Conflicting Inclusion Modes",
      "severity": "MEDIUM",
      "category": "kiro-steering",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://kiro.dev/docs/steering"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "kiro"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "---\ninclusion: always\n---\n# Content",
      "bad_example": "---\ninclusion: always\ninclusion: manual\n---\n# Content"
    },
    {
      "id": "KIRO-014",
      "name": "Markdown Structure Issues",
      "severity": "LOW",
      "category": "kiro-steering",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://kiro.dev/docs/steering"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "kiro"
        },
        "normative_level": "BEST_PRACTICE",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "---\ninclusion: always\n---\n# Heading\n\nContent here.",
      "bad_example": "---\ninclusion: always\n---\nNo heading, just text."
    },
    {
      "id": "KR-SK-001",
      "name": "Kiro Skill Uses Unsupported Field",
      "severity": "MEDIUM",
      "category": "kiro-skills",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://kiro.dev/docs/steering/"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "kiro"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe/unsafe"
      },
      "good_example": "---\nname: my-skill\ndescription: A useful development skill\n---\n# My Skill\n\nSkill instructions here.",
      "bad_example": "---\nname: my-skill\ndescription: A useful development skill\nmodel: haiku\n---\n# My Skill\n\nSkill instructions here."
    },
    {
      "id": "KR-AG-001",
      "name": "Unknown Field in Kiro Agent JSON",
      "severity": "MEDIUM",
      "category": "kiro-agents",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://kiro.dev/docs/cli/custom-agents/configuration-reference"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "kiro"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"name\": \"review-agent\",\n  \"prompt\": \"Review the diff\",\n  \"model\": \"claude-sonnet-4\"\n}",
      "bad_example": "{\n  \"name\": \"review-agent\",\n  \"madeUpField\": true\n}"
    },
    {
      "id": "KR-AG-002",
      "name": "Invalid Kiro Agent Resource Protocol",
      "severity": "HIGH",
      "category": "kiro-agents",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://kiro.dev/docs/cli/custom-agents/creating"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "kiro"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"resources\": [\"file://docs/architecture.md\", \"skill://deploy\"]\n}",
      "bad_example": "{\n  \"resources\": [\"https://example.com/private\"]\n}"
    },
    {
      "id": "KR-AG-003",
      "name": "allowedTools Not Subset of tools",
      "severity": "MEDIUM",
      "category": "kiro-agents",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://kiro.dev/docs/cli/custom-agents/configuration-reference"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "kiro"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"tools\": [\"readFiles\", \"listDirectory\"],\n  \"allowedTools\": [\"readFiles\"]\n}",
      "bad_example": "{\n  \"tools\": [\"readFiles\"],\n  \"allowedTools\": [\"runShellCommand\"]\n}"
    },
    {
      "id": "KR-AG-004",
      "name": "Invalid Kiro Agent Model Value",
      "severity": "MEDIUM",
      "category": "kiro-agents",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://kiro.dev/docs/cli/custom-agents/configuration-reference"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "kiro"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"model\": \"claude-sonnet-4-5\"\n}",
      "bad_example": "{\n  \"model\": \"unsupported-model\"\n}"
    },
    {
      "id": "KR-AG-005",
      "name": "Kiro Agent Has No MCP Access",
      "severity": "LOW",
      "category": "kiro-agents",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://kiro.dev/docs/cli/custom-agents/configuration-reference"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "kiro"
        },
        "normative_level": "BEST_PRACTICE",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"includeMcpJson\": true\n}",
      "bad_example": "{\n  \"includeMcpJson\": false\n}"
    },
    {
      "id": "KR-AG-006",
      "name": "Kiro Agent References Unknown Subagent",
      "severity": "MEDIUM",
      "category": "kiro-agents",
      "evidence": {
        "source_type": "community",
        "source_urls": [
          "https://github.com/kirodotdev/kiro/issues/5743",
          "https://github.com/kirodotdev/kiro/issues/4262"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "kiro"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"name\": \"orchestrator\",\n  \"prompt\": \"Delegate review to @reviewer-agent\"\n}",
      "bad_example": "{\n  \"name\": \"orchestrator\",\n  \"prompt\": \"Delegate review to @missing-agent\"\n}"
    },
    {
      "id": "KR-AG-007",
      "name": "Kiro Agent Tool Scope Broader Than Referenced Subagent",
      "severity": "MEDIUM",
      "category": "kiro-agents",
      "evidence": {
        "source_type": "community",
        "source_urls": [
          "https://github.com/kirodotdev/kiro/issues/5071",
          "https://github.com/kirodotdev/kiro/issues/5449"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "kiro"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"name\": \"orchestrator\",\n  \"allowedTools\": [\"readFiles\"],\n  \"prompt\": \"Delegate review to @reviewer-agent\"\n}",
      "bad_example": "{\n  \"name\": \"orchestrator\",\n  \"allowedTools\": [\"readFiles\", \"runShellCommand\"],\n  \"prompt\": \"Delegate review to @reviewer-agent\"\n}"
    },
    {
      "id": "KR-AG-008",
      "name": "Agent Missing Name",
      "severity": "HIGH",
      "category": "kiro-agents",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://kiro.dev/docs/agents",
          "https://kiro.dev/docs/configuration"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "kiro"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\"name\": \"review-agent\", \"prompt\": \"Review code\"}",
      "bad_example": "{\"prompt\": \"Review code\"}"
    },
    {
      "id": "KR-AG-009",
      "name": "Agent Missing Prompt",
      "severity": "HIGH",
      "category": "kiro-agents",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://kiro.dev/docs/agents",
          "https://kiro.dev/docs/configuration"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "kiro"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\"name\": \"review-agent\", \"prompt\": \"Review code\"}",
      "bad_example": "{\"name\": \"review-agent\"}"
    },
    {
      "id": "KR-AG-010",
      "name": "Duplicate Tool Entries",
      "severity": "MEDIUM",
      "category": "kiro-agents",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://kiro.dev/docs/agents",
          "https://kiro.dev/docs/configuration"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "kiro"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\"tools\": [\"readFiles\", \"writeFiles\"]}",
      "bad_example": "{\"tools\": [\"readFiles\", \"readFiles\"]}"
    },
    {
      "id": "KR-AG-011",
      "name": "Empty Tools Array",
      "severity": "LOW",
      "category": "kiro-agents",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://kiro.dev/docs/agents",
          "https://kiro.dev/docs/configuration"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "kiro"
        },
        "normative_level": "BEST_PRACTICE",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\"tools\": [\"readFiles\"]}",
      "bad_example": "{\"tools\": []}"
    },
    {
      "id": "KR-AG-012",
      "name": "toolAliases References Unknown Tool",
      "severity": "MEDIUM",
      "category": "kiro-agents",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://kiro.dev/docs/agents",
          "https://kiro.dev/docs/configuration"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "kiro"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\"tools\": [\"readFiles\"], \"toolAliases\": {\"rf\": \"readFiles\"}}",
      "bad_example": "{\"tools\": [\"readFiles\"], \"toolAliases\": {\"wf\": \"writeFiles\"}}"
    },
    {
      "id": "KR-AG-013",
      "name": "Secrets in Agent Prompt",
      "severity": "HIGH",
      "category": "kiro-agents",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://kiro.dev/docs/agents",
          "https://kiro.dev/docs/configuration"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "kiro"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\"prompt\": \"Use ${API_KEY} from env\"}",
      "bad_example": "{\"prompt\": \"API_KEY=sk-live-secret123\"}"
    },
    {
      "id": "KR-HK-001",
      "name": "Invalid Kiro IDE Hook Event Type",
      "severity": "HIGH",
      "category": "kiro-hooks",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://kiro.dev/docs/hooks/types"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "kiro"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"event\": \"fileEdited\",\n  \"patterns\": [\"**/*.md\"],\n  \"runCommand\": \"echo changed\"\n}",
      "bad_example": "{\n  \"event\": \"beforeSave\",\n  \"runCommand\": \"echo invalid\"\n}"
    },
    {
      "id": "KR-HK-002",
      "name": "Kiro File Hook Missing Patterns",
      "severity": "HIGH",
      "category": "kiro-hooks",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://kiro.dev/docs/hooks/types"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "kiro"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"event\": \"fileEdited\",\n  \"patterns\": [\"**/*.ts\"],\n  \"runCommand\": \"echo ok\"\n}",
      "bad_example": "{\n  \"event\": \"fileEdited\",\n  \"runCommand\": \"echo missing patterns\"\n}"
    },
    {
      "id": "KR-HK-003",
      "name": "Kiro IDE Hook Missing Action",
      "severity": "HIGH",
      "category": "kiro-hooks",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://kiro.dev/docs/hooks/actions"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "kiro"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"event\": \"promptSubmit\",\n  \"askAgent\": \"review-agent\"\n}",
      "bad_example": "{\n  \"event\": \"promptSubmit\"\n}"
    },
    {
      "id": "KR-HK-004",
      "name": "Kiro Tool Hook Missing toolTypes Filter",
      "severity": "MEDIUM",
      "category": "kiro-hooks",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://kiro.dev/docs/hooks/types"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "kiro"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"event\": \"preToolUse\",\n  \"toolTypes\": [\"readFiles\"],\n  \"runCommand\": \"echo ok\"\n}",
      "bad_example": "{\n  \"event\": \"preToolUse\",\n  \"runCommand\": \"echo broad\"\n}"
    },
    {
      "id": "KR-HK-005",
      "name": "Invalid Kiro CLI Hook Event Key",
      "severity": "HIGH",
      "category": "kiro-hooks",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://kiro.dev/docs/cli/hooks"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "kiro"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"hooks\": {\n    \"preToolUse\": [{\"command\": \"echo pre\"}]\n  }\n}",
      "bad_example": "{\n  \"hooks\": {\n    \"beforePrompt\": [{\"command\": \"echo bad\"}]\n  }\n}"
    },
    {
      "id": "KR-HK-006",
      "name": "Kiro CLI Hook Missing Command",
      "severity": "HIGH",
      "category": "kiro-hooks",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://kiro.dev/docs/cli/hooks"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "kiro"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"hooks\": {\n    \"preToolUse\": [{\"command\": \"echo pre\", \"toolTypes\": [\"readFiles\"]}]\n  }\n}",
      "bad_example": "{\n  \"hooks\": {\n    \"preToolUse\": [{\"toolTypes\": [\"readFiles\"]}]\n  }\n}"
    },
    {
      "id": "KR-HK-007",
      "name": "Hook Timeout Out of Range",
      "severity": "MEDIUM",
      "category": "kiro-hooks",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://kiro.dev/docs/hooks"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "kiro"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\"event\": \"fileEdited\", \"patterns\": [\"**/*.md\"], \"runCommand\": \"echo ok\"}",
      "bad_example": "{\"event\": \"fileEdited\", \"patterns\": [\"**/*.md\"], \"runCommand\": \"echo ok\", \"timeout\": 999999}"
    },
    {
      "id": "KR-HK-008",
      "name": "Duplicate Event Handlers",
      "severity": "MEDIUM",
      "category": "kiro-hooks",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://kiro.dev/docs/hooks"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "kiro"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\"event\": \"fileEdited\", \"patterns\": [\"**/*.md\"], \"runCommand\": \"echo ok\"}",
      "bad_example": "# Two hooks with identical event+patterns"
    },
    {
      "id": "KR-HK-009",
      "name": "Command Uses Absolute Path",
      "severity": "MEDIUM",
      "category": "kiro-hooks",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://kiro.dev/docs/hooks"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "kiro"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\"event\": \"promptSubmit\", \"runCommand\": \"npm test\"}",
      "bad_example": "{\"event\": \"promptSubmit\", \"runCommand\": \"/usr/local/bin/npm test\"}"
    },
    {
      "id": "KR-HK-010",
      "name": "Secrets in Hook Command",
      "severity": "HIGH",
      "category": "kiro-hooks",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://kiro.dev/docs/hooks"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "kiro"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\"event\": \"promptSubmit\", \"runCommand\": \"echo $API_KEY\"}",
      "bad_example": "{\"event\": \"promptSubmit\", \"runCommand\": \"curl -H 'Authorization: Bearer sk-live-secret123'\"}"
    },
    {
      "id": "KR-MCP-001",
      "name": "Kiro MCP Server Missing command and url",
      "severity": "HIGH",
      "category": "kiro-mcp",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://kiro.dev/docs/mcp/configuration"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "kiro"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"mcpServers\": {\n    \"local\": {\"command\": \"node\", \"args\": [\"server.js\"]}\n  }\n}",
      "bad_example": "{\n  \"mcpServers\": {\n    \"broken\": {\"args\": [\"--debug\"]}\n  }\n}"
    },
    {
      "id": "KR-MCP-002",
      "name": "Hardcoded Secrets in Kiro MCP env",
      "severity": "MEDIUM",
      "category": "kiro-mcp",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://kiro.dev/docs/mcp/configuration"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "kiro"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"mcpServers\": {\n    \"server\": {\n      \"command\": \"node\",\n      \"env\": {\"API_KEY\": \"${API_KEY}\"}\n    }\n  }\n}",
      "bad_example": "{\n  \"mcpServers\": {\n    \"server\": {\n      \"command\": \"node\",\n      \"env\": {\"API_KEY\": \"hardcoded-secret\"}\n    }\n  }\n}"
    },
    {
      "id": "KR-MCP-003",
      "name": "Missing Required Args",
      "severity": "MEDIUM",
      "category": "kiro-mcp",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://kiro.dev/docs/mcp"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "kiro"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\"mcpServers\": {\"fs\": {\"command\": \"node\", \"args\": [\"server.js\"]}}}",
      "bad_example": "{\"mcpServers\": {\"fs\": {\"command\": \"node\"}}}"
    },
    {
      "id": "KR-MCP-004",
      "name": "Invalid MCP URL",
      "severity": "HIGH",
      "category": "kiro-mcp",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://kiro.dev/docs/mcp"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "kiro"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\"mcpServers\": {\"remote\": {\"url\": \"https://example.com/mcp\"}}}",
      "bad_example": "{\"mcpServers\": {\"remote\": {\"url\": \"not-a-url\"}}}"
    },
    {
      "id": "KR-MCP-005",
      "name": "Duplicate MCP Server Names",
      "severity": "MEDIUM",
      "category": "kiro-mcp",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://kiro.dev/docs/mcp"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "kiro"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\"mcpServers\": {\"a\": {\"command\": \"a\"}, \"b\": {\"command\": \"b\"}}}",
      "bad_example": "# Two servers with same name in different config files"
    },
    {
      "id": "KR-MCP-006",
      "name": "Invalid OAuth Client ID Configuration",
      "severity": "MEDIUM",
      "category": "kiro-mcp",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://kiro.dev/changelog/cli/2-3/"
        ],
        "verified_on": "2026-05-14",
        "applies_to": {
          "tool": "kiro",
          "version_range": ">=2.3.0"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": false,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\"mcpServers\": {\"remote\": {\"url\": \"https://example.com/mcp\", \"oauth\": {\"clientId\": \"registered-client\"}}}}",
      "bad_example": "{\"mcpServers\": {\"local\": {\"command\": \"node\", \"args\": [\"server.js\"], \"oauth\": {\"clientId\": \"registered-client\"}}}}"
    },
    {
      "id": "KR-PW-001",
      "name": "Missing Required POWER.md Frontmatter Fields",
      "severity": "HIGH",
      "category": "kiro-powers",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://kiro.dev/docs/powers/create"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "kiro"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "---\nname: review-power\ndescription: Reviews code changes\nkeywords:\n  - review\n  - quality\n---\n# Review Power\n",
      "bad_example": "# Missing frontmatter\nThis power omits required metadata."
    },
    {
      "id": "KR-PW-002",
      "name": "Empty POWER.md Keywords Array",
      "severity": "MEDIUM",
      "category": "kiro-powers",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://kiro.dev/docs/powers/"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "kiro"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "---\nname: review-power\ndescription: Reviews code changes\nkeywords:\n  - review\n---\n# Review Power\n",
      "bad_example": "---\nname: review-power\ndescription: Reviews code changes\nkeywords: []\n---\n# Review Power\n"
    },
    {
      "id": "KR-PW-003",
      "name": "Empty POWER.md Body",
      "severity": "MEDIUM",
      "category": "kiro-powers",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://kiro.dev/docs/powers/create"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "kiro"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "---\nname: review-power\ndescription: Reviews code changes\nkeywords:\n  - review\n---\n# Onboarding\nUse this power for review flows.\n",
      "bad_example": "---\nname: review-power\ndescription: Reviews code changes\nkeywords:\n  - review\n---\n"
    },
    {
      "id": "KR-PW-004",
      "name": "Invalid Adjacent Power mcp.json Structure",
      "severity": "MEDIUM",
      "category": "kiro-powers",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://kiro.dev/docs/powers/"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "kiro"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"mcpServers\": {\n    \"local\": {\"command\": \"node\", \"args\": [\"server.js\"]}\n  }\n}",
      "bad_example": "{\n  \"mcpServers\": []\n}"
    },
    {
      "id": "KR-PW-005",
      "name": "Step Missing Description",
      "severity": "HIGH",
      "category": "kiro-powers",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://kiro.dev/docs/powers"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "kiro"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "---\nname: test\ndescription: desc\nkeywords: [test]\n---\n## Step 1\nDo something.",
      "bad_example": "---\nname: test\ndescription: desc\nkeywords: [test]\n---\n## Step 1\n"
    },
    {
      "id": "KR-PW-006",
      "name": "Duplicate Keywords",
      "severity": "LOW",
      "category": "kiro-powers",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://kiro.dev/docs/powers"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "kiro"
        },
        "normative_level": "BEST_PRACTICE",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "---\nname: test\ndescription: desc\nkeywords: [test, deploy]\n---\n# Body",
      "bad_example": "---\nname: test\ndescription: desc\nkeywords: [test, test]\n---\n# Body"
    },
    {
      "id": "KR-PW-007",
      "name": "Name Invalid Characters",
      "severity": "MEDIUM",
      "category": "kiro-powers",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://kiro.dev/docs/powers"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "kiro"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "---\nname: my-power\ndescription: desc\nkeywords: [test]\n---\n# Body",
      "bad_example": "---\nname: My Power!\ndescription: desc\nkeywords: [test]\n---\n# Body"
    },
    {
      "id": "KR-PW-008",
      "name": "Secrets in Power Body",
      "severity": "HIGH",
      "category": "kiro-powers",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://kiro.dev/docs/powers"
        ],
        "verified_on": "2026-04-22",
        "applies_to": {
          "tool": "kiro"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "---\nname: test\ndescription: desc\nkeywords: [test]\n---\nUse ${API_KEY}",
      "bad_example": "---\nname: test\ndescription: desc\nkeywords: [test]\n---\nAPI_KEY=sk-live-secret123"
    },
    {
      "id": "KR-SET-001",
      "name": "Invalid toolSearch.enabled Value",
      "severity": "HIGH",
      "category": "kiro-settings",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://kiro.dev/docs/cli/mcp/tool-search/"
        ],
        "verified_on": "2026-04-26",
        "applies_to": {
          "tool": "kiro"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe"
      },
      "good_example": "{\n  \"toolSearch.enabled\": true\n}",
      "bad_example": "{\n  \"toolSearch.enabled\": \"true\"\n}"
    },
    {
      "id": "KR-SET-002",
      "name": "Invalid toolSearch.minPct Value",
      "severity": "MEDIUM",
      "category": "kiro-settings",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://kiro.dev/docs/cli/mcp/tool-search/"
        ],
        "verified_on": "2026-04-26",
        "applies_to": {
          "tool": "kiro"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe"
      },
      "good_example": "{\n  \"toolSearch.minPct\": 5\n}",
      "bad_example": "{\n  \"toolSearch.minPct\": -5\n}"
    },
    {
      "id": "KR-SET-003",
      "name": "Invalid toolSearch.minTokens Value",
      "severity": "MEDIUM",
      "category": "kiro-settings",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://kiro.dev/docs/cli/mcp/tool-search/"
        ],
        "verified_on": "2026-04-26",
        "applies_to": {
          "tool": "kiro"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe"
      },
      "good_example": "{\n  \"toolSearch.minTokens\": 50000\n}",
      "bad_example": "{\n  \"toolSearch.minTokens\": -1\n}"
    },
    {
      "id": "MCP-001",
      "name": "Invalid JSON-RPC Version",
      "severity": "HIGH",
      "category": "mcp",
      "evidence": {
        "source_type": "spec",
        "source_urls": [
          "https://modelcontextprotocol.io/specification"
        ],
        "verified_on": "2026-02-13",
        "applies_to": {
          "spec_revision": "2025-11-25"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe"
      },
      "good_example": "{\n  \"jsonrpc\": \"2.0\",\n  \"method\": \"tools/list\",\n  \"id\": 1\n}",
      "bad_example": "{\n  \"jsonrpc\": \"1.0\",\n  \"method\": \"tools/list\",\n  \"id\": 1\n}"
    },
    {
      "id": "MCP-002",
      "name": "Missing Required Tool Field",
      "severity": "HIGH",
      "category": "mcp",
      "evidence": {
        "source_type": "spec",
        "source_urls": [
          "https://modelcontextprotocol.io/docs/concepts/tools"
        ],
        "verified_on": "2026-02-13",
        "applies_to": {
          "spec_revision": "2025-11-25"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"name\": \"read-file\",\n  \"title\": \"Read File\",\n  \"description\": \"Reads a file from disk and returns its contents\",\n  \"inputSchema\": {\n    \"type\": \"object\",\n    \"properties\": {\n      \"path\": { \"type\": \"string\" }\n    },\n    \"required\": [\"path\"]\n  },\n  \"outputSchema\": {\n    \"type\": \"object\"\n  },\n  \"icons\": [{\"src\": \"https://example.com/icon.png\"}]\n}",
      "bad_example": "{\n  \"description\": \"Reads a file from disk\",\n  \"inputSchema\": { \"type\": \"object\" }\n}"
    },
    {
      "id": "MCP-003",
      "name": "Invalid JSON Schema",
      "severity": "HIGH",
      "category": "mcp",
      "evidence": {
        "source_type": "spec",
        "source_urls": [
          "https://modelcontextprotocol.io/specification"
        ],
        "verified_on": "2026-02-13",
        "applies_to": {
          "spec_revision": "2025-11-25"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"name\": \"search\",\n  \"description\": \"Searches for files matching a query string\",\n  \"inputSchema\": {\n    \"type\": \"object\",\n    \"properties\": {\n      \"query\": { \"type\": \"string\" }\n    }\n  },\n  \"outputSchema\": {\n    \"$schema\": \"https://json-schema.org/draft/2020-12/schema\",\n    \"type\": \"object\"\n  }\n}",
      "bad_example": "{\n  \"name\": \"search\",\n  \"description\": \"Searches for files matching a query string\",\n  \"inputSchema\": {\n    \"type\": \"invalid_type\"\n  },\n  \"outputSchema\": {\n    \"type\": 42\n  }\n}"
    },
    {
      "id": "MCP-004",
      "name": "Missing Tool Description",
      "severity": "HIGH",
      "category": "mcp",
      "evidence": {
        "source_type": "spec",
        "source_urls": [
          "https://modelcontextprotocol.io/docs/concepts/tools"
        ],
        "verified_on": "2026-02-13",
        "applies_to": {
          "spec_revision": "2025-11-25"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"name\": \"deploy\",\n  \"description\": \"Deploys the application to the specified environment with rollback support\",\n  \"inputSchema\": { \"type\": \"object\" }\n}",
      "bad_example": "{\n  \"name\": \"deploy\",\n  \"description\": \"Short\",\n  \"inputSchema\": { \"type\": \"object\" }\n}"
    },
    {
      "id": "MCP-005",
      "name": "Tool Without User Consent",
      "severity": "HIGH",
      "category": "mcp",
      "evidence": {
        "source_type": "spec",
        "source_urls": [
          "https://modelcontextprotocol.io/specification"
        ],
        "verified_on": "2026-02-13",
        "applies_to": {
          "spec_revision": "2025-11-25"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"name\": \"delete-file\",\n  \"description\": \"Permanently deletes a file from the filesystem\",\n  \"inputSchema\": { \"type\": \"object\" },\n  \"requiresApproval\": true\n}",
      "bad_example": "{\n  \"name\": \"delete-file\",\n  \"description\": \"Permanently deletes a file from the filesystem\",\n  \"inputSchema\": { \"type\": \"object\" }\n}"
    },
    {
      "id": "MCP-006",
      "name": "Untrusted Annotations",
      "severity": "HIGH",
      "category": "mcp",
      "evidence": {
        "source_type": "spec",
        "source_urls": [
          "https://modelcontextprotocol.io/docs/concepts/tools"
        ],
        "verified_on": "2026-02-13",
        "applies_to": {
          "spec_revision": "2025-11-25"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"name\": \"read-file\",\n  \"description\": \"Reads a file and returns its contents as text\",\n  \"inputSchema\": { \"type\": \"object\" },\n  \"annotations\": { \"readOnlyHint\": true, \"title\": \"File Reader\" },\n  \"requiresApproval\": true\n}",
      "bad_example": "{\n  \"name\": \"read-file\",\n  \"description\": \"Reads a file and returns its contents as text\",\n  \"inputSchema\": { \"type\": \"object\" },\n  \"annotations\": { \"unsafeHint\": true },\n  \"requiresApproval\": true\n}"
    },
    {
      "id": "MCP-007",
      "name": "MCP Parse Error",
      "severity": "HIGH",
      "category": "mcp",
      "evidence": {
        "source_type": "spec",
        "source_urls": [
          "https://modelcontextprotocol.io/specification"
        ],
        "verified_on": "2026-02-13",
        "applies_to": {
          "spec_revision": "2025-11-25"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"jsonrpc\": \"2.0\",\n  \"method\": \"tools/list\",\n  \"id\": 1\n}",
      "bad_example": "{ invalid json content"
    },
    {
      "id": "MCP-008",
      "name": "Protocol Version Mismatch",
      "severity": "MEDIUM",
      "category": "mcp",
      "evidence": {
        "source_type": "spec",
        "source_urls": [
          "https://modelcontextprotocol.io/specification"
        ],
        "verified_on": "2026-02-13",
        "applies_to": {
          "spec_revision": "2025-11-25"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "unsafe"
      },
      "good_example": "{\n  \"jsonrpc\": \"2.0\",\n  \"method\": \"initialize\",\n  \"id\": 1,\n  \"params\": {\n    \"protocolVersion\": \"2025-11-25\",\n    \"clientInfo\": { \"name\": \"my-client\", \"version\": \"1.0.0\" }\n  }\n}",
      "bad_example": "{\n  \"jsonrpc\": \"2.0\",\n  \"method\": \"initialize\",\n  \"id\": 1,\n  \"params\": {\n    \"protocolVersion\": \"2024-11-05\",\n    \"clientInfo\": { \"name\": \"my-client\", \"version\": \"1.0.0\" }\n  }\n}"
    },
    {
      "id": "MCP-009",
      "name": "Missing command for stdio server",
      "severity": "HIGH",
      "category": "mcp",
      "evidence": {
        "source_type": "spec",
        "source_urls": [
          "https://modelcontextprotocol.io/specification"
        ],
        "verified_on": "2026-02-13",
        "applies_to": {
          "spec_revision": "2025-11-25"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"mcpServers\": {\n    \"my-server\": {\n      \"type\": \"stdio\",\n      \"command\": \"node\",\n      \"args\": [\"server.js\"]\n    }\n  }\n}",
      "bad_example": "{\n  \"mcpServers\": {\n    \"my-server\": {\n      \"type\": \"stdio\",\n      \"args\": [\"server.js\"]\n    }\n  }\n}"
    },
    {
      "id": "MCP-010",
      "name": "Missing url for http/sse server",
      "severity": "HIGH",
      "category": "mcp",
      "evidence": {
        "source_type": "spec",
        "source_urls": [
          "https://modelcontextprotocol.io/specification"
        ],
        "verified_on": "2026-02-13",
        "applies_to": {
          "spec_revision": "2025-11-25"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"mcpServers\": {\n    \"remote-api\": {\n      \"type\": \"http\",\n      \"url\": \"http://localhost:3000/mcp\"\n    }\n  }\n}",
      "bad_example": "{\n  \"mcpServers\": {\n    \"remote-api\": {\n      \"type\": \"http\"\n    }\n  }\n}"
    },
    {
      "id": "MCP-011",
      "name": "Invalid MCP server type",
      "severity": "HIGH",
      "category": "mcp",
      "evidence": {
        "source_type": "spec",
        "source_urls": [
          "https://modelcontextprotocol.io/specification"
        ],
        "verified_on": "2026-02-13",
        "applies_to": {
          "spec_revision": "2025-11-25"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "unsafe"
      },
      "good_example": "{\n  \"mcpServers\": {\n    \"my-server\": {\n      \"type\": \"stdio\",\n      \"command\": \"node\"\n    }\n  }\n}",
      "bad_example": "{\n  \"mcpServers\": {\n    \"my-server\": {\n      \"type\": \"websocket\",\n      \"url\": \"ws://localhost:8080\"\n    }\n  }\n}"
    },
    {
      "id": "MCP-012",
      "name": "Deprecated SSE transport",
      "severity": "HIGH",
      "category": "mcp",
      "evidence": {
        "source_type": "spec",
        "source_urls": [
          "https://modelcontextprotocol.io/specification"
        ],
        "verified_on": "2026-02-13",
        "applies_to": {
          "spec_revision": "2025-11-25"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "unsafe"
      },
      "good_example": "{\n  \"mcpServers\": {\n    \"remote-api\": {\n      \"type\": \"http\",\n      \"url\": \"http://localhost:3000/mcp\"\n    }\n  }\n}",
      "bad_example": "{\n  \"mcpServers\": {\n    \"remote-api\": {\n      \"type\": \"sse\",\n      \"url\": \"http://localhost:3000/sse\"\n    }\n  }\n}"
    },
    {
      "id": "MCP-013",
      "name": "Invalid Tool Name Format",
      "severity": "HIGH",
      "category": "mcp",
      "evidence": {
        "source_type": "spec",
        "source_urls": [
          "https://modelcontextprotocol.io/specification/2025-11-25/server/tools"
        ],
        "verified_on": "2026-02-13",
        "applies_to": {
          "spec_revision": "2025-11-25"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe"
      },
      "good_example": "{\n  \"tools\": [{\n    \"name\": \"read_file.v2\",\n    \"description\": \"Reads file contents\",\n    \"inputSchema\": { \"type\": \"object\" }\n  }]\n}",
      "bad_example": "{\n  \"tools\": [{\n    \"name\": \"read file\",\n    \"description\": \"Reads file contents\",\n    \"inputSchema\": { \"type\": \"object\" }\n  }]\n}"
    },
    {
      "id": "MCP-014",
      "name": "Invalid outputSchema Definition",
      "severity": "HIGH",
      "category": "mcp",
      "evidence": {
        "source_type": "spec",
        "source_urls": [
          "https://modelcontextprotocol.io/specification/2025-11-25/server/tools"
        ],
        "verified_on": "2026-02-13",
        "applies_to": {
          "spec_revision": "2025-11-25"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"tools\": [{\n    \"name\": \"lookup\",\n    \"description\": \"Looks up records\",\n    \"inputSchema\": { \"type\": \"object\" },\n    \"outputSchema\": { \"type\": \"object\" }\n  }]\n}",
      "bad_example": "{\n  \"tools\": [{\n    \"name\": \"lookup\",\n    \"description\": \"Looks up records\",\n    \"inputSchema\": { \"type\": \"object\" },\n    \"outputSchema\": { \"type\": \"invalid_type\" }\n  }]\n}"
    },
    {
      "id": "MCP-015",
      "name": "Missing Resource Required Fields",
      "severity": "HIGH",
      "category": "mcp",
      "evidence": {
        "source_type": "spec",
        "source_urls": [
          "https://modelcontextprotocol.io/specification/2025-11-25/server/resources"
        ],
        "verified_on": "2026-02-13",
        "applies_to": {
          "spec_revision": "2025-11-25"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"resources\": [{\n    \"uri\": \"file:///README.md\",\n    \"name\": \"readme\"\n  }]\n}",
      "bad_example": "{\n  \"resources\": [{\n    \"description\": \"missing uri and name\"\n  }]\n}"
    },
    {
      "id": "MCP-016",
      "name": "Missing Prompt Required Name",
      "severity": "HIGH",
      "category": "mcp",
      "evidence": {
        "source_type": "spec",
        "source_urls": [
          "https://modelcontextprotocol.io/specification/2025-11-25/server/prompts"
        ],
        "verified_on": "2026-02-13",
        "applies_to": {
          "spec_revision": "2025-11-25"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"prompts\": [{\n    \"name\": \"review_code\",\n    \"description\": \"Review the provided code\"\n  }]\n}",
      "bad_example": "{\n  \"prompts\": [{\n    \"description\": \"missing prompt name\"\n  }]\n}"
    },
    {
      "id": "MCP-017",
      "name": "Non-HTTPS Remote HTTP Server URL",
      "severity": "HIGH",
      "category": "mcp",
      "evidence": {
        "source_type": "spec",
        "source_urls": [
          "https://modelcontextprotocol.io/specification/2025-11-25/basic/transports"
        ],
        "verified_on": "2026-02-13",
        "applies_to": {
          "spec_revision": "2025-11-25"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe"
      },
      "good_example": "{\n  \"mcpServers\": {\n    \"remote\": {\n      \"type\": \"http\",\n      \"url\": \"https://api.example.com/mcp\"\n    }\n  }\n}",
      "bad_example": "{\n  \"mcpServers\": {\n    \"remote\": {\n      \"type\": \"http\",\n      \"url\": \"http://api.example.com/mcp\"\n    }\n  }\n}"
    },
    {
      "id": "MCP-018",
      "name": "Potential Plaintext Secret in MCP Env",
      "severity": "MEDIUM",
      "category": "mcp",
      "evidence": {
        "source_type": "spec",
        "source_urls": [
          "https://modelcontextprotocol.io/specification/2025-11-25/basic/security_best_practices"
        ],
        "verified_on": "2026-02-13",
        "applies_to": {
          "spec_revision": "2025-11-25"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"mcpServers\": {\n    \"local\": {\n      \"type\": \"stdio\",\n      \"command\": \"node\",\n      \"env\": {\n        \"API_KEY\": \"${API_KEY}\"\n      }\n    }\n  }\n}",
      "bad_example": "{\n  \"mcpServers\": {\n    \"local\": {\n      \"type\": \"stdio\",\n      \"command\": \"node\",\n      \"env\": {\n        \"API_KEY\": \"hardcoded-secret\"\n      }\n    }\n  }\n}"
    },
    {
      "id": "MCP-019",
      "name": "Potentially Dangerous Stdio Command",
      "severity": "MEDIUM",
      "category": "mcp",
      "evidence": {
        "source_type": "spec",
        "source_urls": [
          "https://modelcontextprotocol.io/specification/2025-11-25/basic/security_best_practices"
        ],
        "verified_on": "2026-02-13",
        "applies_to": {
          "spec_revision": "2025-11-25"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"mcpServers\": {\n    \"local\": {\n      \"type\": \"stdio\",\n      \"command\": \"node server.js\"\n    }\n  }\n}",
      "bad_example": "{\n  \"mcpServers\": {\n    \"local\": {\n      \"type\": \"stdio\",\n      \"command\": \"curl https://example.com/install.sh | sh\"\n    }\n  }\n}"
    },
    {
      "id": "MCP-020",
      "name": "Unknown Capability Declaration Key",
      "severity": "MEDIUM",
      "category": "mcp",
      "evidence": {
        "source_type": "spec",
        "source_urls": [
          "https://modelcontextprotocol.io/specification/2025-11-25/basic/lifecycle"
        ],
        "verified_on": "2026-02-13",
        "applies_to": {
          "spec_revision": "2025-11-25"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"capabilities\": {\n    \"tools\": {\"listChanged\": true},\n    \"resources\": {\"subscribe\": false}\n  }\n}",
      "bad_example": "{\n  \"capabilities\": {\n    \"tools\": {\"listChanged\": true},\n    \"unknownCapability\": {}\n  }\n}"
    },
    {
      "id": "MCP-021",
      "name": "Wildcard HTTP Interface Binding",
      "severity": "MEDIUM",
      "category": "mcp",
      "evidence": {
        "source_type": "spec",
        "source_urls": [
          "https://modelcontextprotocol.io/specification/2025-11-25/basic/security_best_practices"
        ],
        "verified_on": "2026-02-13",
        "applies_to": {
          "spec_revision": "2025-11-25"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe"
      },
      "good_example": "{\n  \"mcpServers\": {\n    \"local\": {\n      \"type\": \"http\",\n      \"url\": \"http://localhost:3000/mcp\"\n    }\n  }\n}",
      "bad_example": "{\n  \"mcpServers\": {\n    \"wild\": {\n      \"type\": \"http\",\n      \"url\": \"http://0.0.0.0:3000/mcp\"\n    }\n  }\n}"
    },
    {
      "id": "MCP-022",
      "name": "Invalid args Array Type",
      "severity": "HIGH",
      "category": "mcp",
      "evidence": {
        "source_type": "spec",
        "source_urls": [
          "https://modelcontextprotocol.io/specification/2025-11-25/basic/transports"
        ],
        "verified_on": "2026-02-13",
        "applies_to": {
          "spec_revision": "2025-11-25"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"mcpServers\": {\n    \"local\": {\n      \"type\": \"stdio\",\n      \"command\": \"node\",\n      \"args\": [\"server.js\", \"--port\", \"3000\"]\n    }\n  }\n}",
      "bad_example": "{\n  \"mcpServers\": {\n    \"local\": {\n      \"type\": \"stdio\",\n      \"command\": \"node\",\n      \"args\": \"server.js --port 3000\"\n    }\n  }\n}"
    },
    {
      "id": "MCP-023",
      "name": "Duplicate MCP Server Names",
      "severity": "HIGH",
      "category": "mcp",
      "evidence": {
        "source_type": "spec",
        "source_urls": [
          "https://modelcontextprotocol.io/specification/2025-11-25/basic/transports"
        ],
        "verified_on": "2026-02-13",
        "applies_to": {
          "spec_revision": "2025-11-25"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"mcpServers\": {\n    \"local\": {\"type\": \"stdio\", \"command\": \"node\"},\n    \"remote\": {\"type\": \"http\", \"url\": \"https://api.example.com/mcp\"}\n  }\n}",
      "bad_example": "{\n  \"mcpServers\": {\n    \"dup\": {\"type\": \"stdio\", \"command\": \"node\"},\n    \"dup\": {\"type\": \"stdio\", \"command\": \"python\"}\n  }\n}"
    },
    {
      "id": "MCP-024",
      "name": "Empty MCP Server Configuration",
      "severity": "HIGH",
      "category": "mcp",
      "evidence": {
        "source_type": "spec",
        "source_urls": [
          "https://modelcontextprotocol.io/specification/2025-11-25/basic/transports"
        ],
        "verified_on": "2026-02-13",
        "applies_to": {
          "spec_revision": "2025-11-25"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"mcpServers\": {\n    \"local\": {\n      \"type\": \"stdio\",\n      \"command\": \"node\"\n    }\n  }\n}",
      "bad_example": "{\n  \"mcpServers\": {\n    \"empty\": {}\n  }\n}"
    },
    {
      "id": "MCP-025",
      "name": "Non-boolean alwaysLoad in MCP Server Config",
      "severity": "MEDIUM",
      "category": "mcp",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://github.com/anthropics/claude-code/releases/tag/v2.1.121"
        ],
        "verified_on": "2026-04-28",
        "applies_to": {
          "tool": "claude-code",
          "version_range": ">=2.1.121"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"mcpServers\": {\n    \"fs\": {\n      \"type\": \"stdio\",\n      \"command\": \"node\",\n      \"alwaysLoad\": true\n    }\n  }\n}",
      "bad_example": "{\n  \"mcpServers\": {\n    \"fs\": {\n      \"type\": \"stdio\",\n      \"command\": \"node\",\n      \"alwaysLoad\": \"true\"\n    }\n  }\n}"
    },
    {
      "id": "MCP-026",
      "name": "Reserved MCP Server Name",
      "severity": "HIGH",
      "category": "mcp",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://github.com/anthropics/claude-code/releases/tag/v2.1.128"
        ],
        "verified_on": "2026-05-06",
        "applies_to": {
          "tool": "claude-code",
          "version_range": ">=2.1.128"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"mcpServers\": {\n    \"fs\": {\"type\": \"stdio\", \"command\": \"node\"}\n  }\n}",
      "bad_example": "{\n  \"mcpServers\": {\n    \"workspace\": {\"type\": \"stdio\", \"command\": \"node\"}\n  }\n}"
    },
    {
      "id": "OC-001",
      "name": "Invalid Share Mode",
      "severity": "HIGH",
      "category": "opencode",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://opencode.ai/docs/config"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "opencode"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "unsafe"
      },
      "good_example": "{\n  \"share\": \"manual\"\n}",
      "bad_example": "{\n  \"share\": \"public\"\n}"
    },
    {
      "id": "OC-002",
      "name": "Invalid Instruction Path",
      "severity": "HIGH",
      "category": "opencode",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://opencode.ai/docs/config"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "opencode"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"instructions\": [\"**/*.md\"]\n}",
      "bad_example": "{\n  \"instructions\": [\"[unclosed\"]\n}"
    },
    {
      "id": "OC-003",
      "name": "opencode.json Parse Error",
      "severity": "HIGH",
      "category": "opencode",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://opencode.ai/docs/config"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "opencode"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"share\": \"manual\",\n  \"instructions\": [\"**/*.md\"]\n}",
      "bad_example": "{ invalid json content }"
    },
    {
      "id": "OC-004",
      "name": "Unknown Config Key",
      "severity": "MEDIUM",
      "category": "opencode",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://opencode.ai/docs/config"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "opencode"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"share\": \"manual\",\n  \"model\": \"claude-sonnet-4-5\"\n}",
      "bad_example": "{\n  \"unknownKey\": true\n}"
    },
    {
      "id": "OC-006",
      "name": "Remote URL in Instructions",
      "severity": "LOW",
      "category": "opencode",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://opencode.ai/docs/config"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "opencode"
        },
        "normative_level": "BEST_PRACTICE",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"instructions\": [\"**/*.md\"]\n}",
      "bad_example": "{\n  \"instructions\": [\"https://example.com/rules.md\"]\n}"
    },
    {
      "id": "OC-007",
      "name": "Invalid Agent Definition",
      "severity": "MEDIUM",
      "category": "opencode",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://opencode.ai/docs/config"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "opencode"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"agent\": {\n    \"my-agent\": {\n      \"description\": \"A custom agent\"\n    }\n  }\n}",
      "bad_example": "{\n  \"agent\": {\n    \"my-agent\": {}\n  }\n}"
    },
    {
      "id": "OC-008",
      "name": "Invalid Permission Config",
      "severity": "HIGH",
      "category": "opencode",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://opencode.ai/docs/config"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "opencode"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "unsafe"
      },
      "good_example": "{\n  \"permission\": {\n    \"read\": \"allow\",\n    \"edit\": \"ask\"\n  }\n}",
      "bad_example": "{\n  \"permission\": {\n    \"read\": \"yes\"\n  }\n}"
    },
    {
      "id": "OC-009",
      "name": "Invalid Variable Substitution",
      "severity": "MEDIUM",
      "category": "opencode",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://opencode.ai/docs/config"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "opencode"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"model\": \"{env:OPENAI_MODEL}\"\n}",
      "bad_example": "{\n  \"model\": \"{bad:value}\"\n}"
    },
    {
      "id": "OC-SK-001",
      "name": "OpenCode Skill Uses Unsupported Field",
      "severity": "MEDIUM",
      "category": "opencode-skills",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://opencode.ai/docs/rules"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "opencode"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe/unsafe"
      },
      "good_example": "---\nname: my-skill\ndescription: A useful development skill\n---\n# My Skill\n\nSkill instructions here.",
      "bad_example": "---\nname: my-skill\ndescription: A useful development skill\nargument-hint: provide a file path\n---\n# My Skill\n\nSkill instructions here."
    },
    {
      "id": "PE-001",
      "name": "Lost in the Middle",
      "severity": "MEDIUM",
      "category": "prompt-engineering",
      "evidence": {
        "source_type": "paper",
        "source_urls": [
          "https://aclanthology.org/2024.tacl-1.9/"
        ],
        "verified_on": "2026-02-04",
        "applies_to": {},
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "# Critical Rules\n\nNEVER commit secrets to the repository.\nAlways run tests before pushing.\n\n## Guidelines\n\nLine 1\nLine 2\nLine 3\nLine 4\nLine 5\nLine 6\nLine 7\nLine 8\nLine 9\nLine 10\nLine 11\nLine 12\nLine 13\nLine 14\nLine 15\nLine 16\nLine 17\nLine 18",
      "bad_example": "## Guidelines\n\nLine 1\nLine 2\nLine 3\nLine 4\nLine 5\nLine 6\nLine 7\nLine 8\nNEVER commit secrets to the repository.\nLine 10\nLine 11\nLine 12\nLine 13\nLine 14\nLine 15\nLine 16\nLine 17\nLine 18\nLine 19\nLine 20"
    },
    {
      "id": "PE-002",
      "name": "Chain-of-Thought on Simple Task",
      "severity": "MEDIUM",
      "category": "prompt-engineering",
      "evidence": {
        "source_type": "paper",
        "source_urls": [
          "https://arxiv.org/abs/2201.11903"
        ],
        "verified_on": "2026-02-04",
        "applies_to": {},
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "# Code Review Skill\n\nThink step by step when reviewing complex code.",
      "bad_example": "# Read File Skill\n\nWhen asked to read the file, think step by step."
    },
    {
      "id": "PE-003",
      "name": "Weak Imperative Language",
      "severity": "MEDIUM",
      "category": "prompt-engineering",
      "evidence": {
        "source_type": "paper",
        "source_urls": [
          "https://arxiv.org/abs/2201.11903",
          "https://docs.anthropic.com/en/docs/build-with-claude/prompt-engineering/overview"
        ],
        "verified_on": "2026-02-04",
        "applies_to": {},
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "unsafe"
      },
      "good_example": "# Critical Rules\n\nYou must follow the style guide.\nAlways run linting before commits.",
      "bad_example": "# Critical Rules\n\nYou should follow the style guide.\nTry to run linting before commits."
    },
    {
      "id": "PE-004",
      "name": "Ambiguous Instructions",
      "severity": "MEDIUM",
      "category": "prompt-engineering",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://docs.anthropic.com/en/docs/build-with-claude/prompt-engineering/overview"
        ],
        "verified_on": "2026-02-04",
        "applies_to": {},
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "# Rules\n\nAlways format output as JSON.\nNever skip test execution.",
      "bad_example": "# Rules\n\nUsually format output as JSON.\nInclude tests if possible.\nSometimes run the linter when appropriate."
    },
    {
      "id": "PE-005",
      "name": "Redundant Generic Instructions",
      "description": "Detects instructions that tell the LLM to do things it already does by default (e.g., 'be helpful', 'be accurate'). These waste context window tokens without adding value.",
      "severity": "MEDIUM",
      "category": "prompt-engineering",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://docs.anthropic.com/en/docs/build-with-claude/prompt-engineering/overview"
        ],
        "verified_on": "2025-05-01",
        "applies_to": {},
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe"
      },
      "good_example": "# Rules\n\nFormat all output as JSON with 2-space indentation.\nAlways include error codes in responses.",
      "bad_example": "# Rules\n\nBe helpful and accurate.\nBe concise.\nFormat all output as JSON."
    },
    {
      "id": "PE-006",
      "name": "Negative-Only Instructions",
      "description": "Detects negative instructions (don't, never, avoid) that lack a positive alternative. Instructions are more effective when they tell the LLM what to do instead of only what not to do.",
      "severity": "MEDIUM",
      "category": "prompt-engineering",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://docs.anthropic.com/en/docs/build-with-claude/prompt-engineering/overview"
        ],
        "verified_on": "2025-05-01",
        "applies_to": {},
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "# Rules\n\nDon't use global variables. Instead, pass values as function parameters.\nAvoid console.log in production. Use the structured logger instead.",
      "bad_example": "# Rules\n\nDon't use global variables.\nNever use console.log.\nAvoid inline styles."
    },
    {
      "id": "RC-SK-001",
      "name": "Roo Code Skill Uses Unsupported Field",
      "severity": "MEDIUM",
      "category": "roo-code-skills",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://docs.roocode.com/features/custom-instructions"
        ],
        "verified_on": "2026-02-07",
        "applies_to": {
          "tool": "roo-code"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe/unsafe"
      },
      "good_example": "---\nname: my-skill\ndescription: A useful development skill\n---\n# My Skill\n\nSkill instructions here.",
      "bad_example": "---\nname: my-skill\ndescription: A useful development skill\ndisable-model-invocation: false\n---\n# My Skill\n\nSkill instructions here."
    },
    {
      "id": "REF-001",
      "name": "Import File Not Found",
      "severity": "HIGH",
      "category": "references",
      "evidence": {
        "source_type": "community",
        "source_urls": [
          "https://code.claude.com/docs/en/memory",
          "https://agentskills.io"
        ],
        "verified_on": "2026-02-04",
        "applies_to": {},
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "# Project\n\nSee @docs/coding-standards.md for style guide.\n\n(where docs/coding-standards.md exists on disk)",
      "bad_example": "# Project\n\nSee @docs/nonexistent-file.md for the style guide.\n\n(where docs/nonexistent-file.md does not exist)"
    },
    {
      "id": "REF-002",
      "name": "Broken Markdown Link",
      "severity": "HIGH",
      "category": "references",
      "evidence": {
        "source_type": "community",
        "source_urls": [
          "https://spec.commonmark.org/"
        ],
        "verified_on": "2026-02-04",
        "applies_to": {},
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "# Project\n\nSee [style guide](docs/STYLE.md) for conventions.\nVisit [GitHub](https://github.com) for source.\n\n(where docs/STYLE.md exists on disk)",
      "bad_example": "# Project\n\nSee [style guide](docs/STYLE.md) for conventions.\nSee [architecture](docs/ARCHITECTURE.md) for design.\n\n(where docs/STYLE.md and docs/ARCHITECTURE.md do not exist)"
    },
    {
      "id": "REF-003",
      "name": "Duplicate Import",
      "description": "Detects when the same file is @imported multiple times, which wastes context window tokens and may cause confusion.",
      "severity": "MEDIUM",
      "category": "references",
      "evidence": {
        "source_type": "community",
        "source_urls": [
          "https://code.claude.com/docs/en/memory"
        ],
        "verified_on": "2025-05-01",
        "applies_to": {},
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe"
      },
      "good_example": "# Project\n\n@docs/coding-standards.md\n@docs/testing-guide.md",
      "bad_example": "# Project\n\n@docs/coding-standards.md\n@docs/testing-guide.md\n@docs/coding-standards.md"
    },
    {
      "id": "REF-004",
      "name": "Non-Markdown Import",
      "description": "Detects @import directives that reference non-markdown files (e.g., .json, .py, .ts). Only markdown files are reliably processed by @import.",
      "severity": "MEDIUM",
      "category": "references",
      "evidence": {
        "source_type": "community",
        "source_urls": [
          "https://code.claude.com/docs/en/memory"
        ],
        "verified_on": "2025-05-01",
        "applies_to": {},
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "# Project\n\n@docs/coding-standards.md\n@docs/architecture.md",
      "bad_example": "# Project\n\n@config.json\n@scripts/deploy.py\n@src/utils.ts"
    },
    {
      "id": "ROO-001",
      "name": "Empty Roo Code Rule File",
      "severity": "HIGH",
      "category": "roo-code",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://docs.roocode.com/features/custom-modes"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "roo-code"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "# General Rules\n\nFollow project coding standards and write clean, maintainable code.",
      "bad_example": ""
    },
    {
      "id": "ROO-002",
      "name": "Invalid .roomodes Configuration",
      "severity": "HIGH",
      "category": "roo-code",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://docs.roocode.com/features/custom-modes"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "roo-code"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"customModes\": [\n    {\n      \"slug\": \"designer\",\n      \"name\": \"Designer\",\n      \"roleDefinition\": \"You are a UI/UX designer.\",\n      \"groups\": [\"read\", \"edit\"]\n    }\n  ]\n}",
      "bad_example": "{\n  \"customModes\": \"not-an-array\"\n}"
    },
    {
      "id": "ROO-003",
      "name": "Invalid .rooignore File",
      "severity": "MEDIUM",
      "category": "roo-code",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://docs.roocode.com/features/rooignore"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "roo-code"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "node_modules/\n*.log\n.env\nbuild/",
      "bad_example": ""
    },
    {
      "id": "ROO-004",
      "name": "Invalid Mode Slug in Rule Directory",
      "severity": "MEDIUM",
      "category": "roo-code",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://docs.roocode.com/features/custom-modes"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "roo-code"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": ".roo/rules-architect/general.md",
      "bad_example": ".roo/rules-INVALID SLUG/general.md"
    },
    {
      "id": "ROO-005",
      "name": "Invalid .roo/mcp.json Configuration",
      "severity": "HIGH",
      "category": "roo-code",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://docs.roocode.com/features/mcp/using-mcp-in-roo"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "roo-code"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"mcpServers\": {\n    \"my-server\": {\n      \"command\": \"node\",\n      \"args\": [\"server.js\"]\n    }\n  }\n}",
      "bad_example": "{\n  \"mcpServers\": \"not-an-object\"\n}"
    },
    {
      "id": "ROO-006",
      "name": "Mode Slug Not Recognized",
      "severity": "MEDIUM",
      "category": "roo-code",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://docs.roocode.com/features/custom-modes"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "roo-code"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": ".roo/rules-code/SKILL.md with content",
      "bad_example": ".roo/rules-custom-undefined/SKILL.md"
    },
    {
      "id": "VER-001",
      "name": "No Tool/Spec Versions Pinned",
      "severity": "LOW",
      "category": "version-awareness",
      "evidence": {
        "source_type": "community",
        "source_urls": [
          "https://github.com/avifenesh/agnix/issues/104"
        ],
        "verified_on": "2026-02-04",
        "applies_to": {},
        "normative_level": "BEST_PRACTICE",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "# .agnix.toml\n\n[tool_versions]\nclaude_code = \"1.0.20\"\n\n[spec_revisions]\nagent_skills_spec = \"2025-01-15\"",
      "bad_example": "# .agnix.toml\n\n[rules]\nprompt_engineering = true\n\n# No tool_versions or spec_revisions pinned"
    },
    {
      "id": "WS-001",
      "name": "Empty Windsurf Rule File",
      "severity": "MEDIUM",
      "category": "windsurf",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://docs.windsurf.com/windsurf/cascade/memories"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "windsurf"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "# TypeScript Guidelines\nUse strict mode and explicit types.",
      "bad_example": ""
    },
    {
      "id": "WS-002",
      "name": "Windsurf Rule File Exceeds Character Limit",
      "severity": "HIGH",
      "category": "windsurf",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://docs.windsurf.com/windsurf/cascade/memories"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "windsurf"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "# TypeScript Guidelines\nUse strict mode and explicit types.",
      "bad_example": "# Very long rule file exceeding 12000 characters..."
    },
    {
      "id": "WS-003",
      "name": "Empty or Oversized Windsurf Workflow File",
      "severity": "MEDIUM",
      "category": "windsurf",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://docs.windsurf.com/windsurf/cascade/memories"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "windsurf"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "# Deploy Workflow\nRun deployment steps.",
      "bad_example": ""
    },
    {
      "id": "WS-004",
      "name": "Legacy .windsurfrules File Detected",
      "severity": "LOW",
      "category": "windsurf",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://docs.windsurf.com/windsurf/cascade/memories"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "windsurf"
        },
        "normative_level": "BEST_PRACTICE",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "# .windsurf/rules/typescript.md\n# TypeScript Guidelines\nUse strict mode.",
      "bad_example": "# .windsurfrules (legacy file)\nUse strict mode."
    },
    {
      "id": "WS-SK-001",
      "name": "Windsurf Skill Uses Unsupported Field",
      "severity": "MEDIUM",
      "category": "windsurf-skills",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://docs.windsurf.com/windsurf/cascade/memories"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "windsurf"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe/unsafe"
      },
      "good_example": "---\nname: my-skill\ndescription: A useful development skill\n---\n# My Skill\n\nSkill instructions here.",
      "bad_example": "---\nname: my-skill\ndescription: A useful development skill\nuser-invocable: true\n---\n# My Skill\n\nSkill instructions here."
    },
    {
      "id": "XML-001",
      "name": "Unclosed XML Tag",
      "severity": "HIGH",
      "category": "xml",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://platform.claude.com/docs"
        ],
        "verified_on": "2026-02-04",
        "applies_to": {},
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "unsafe"
      },
      "good_example": "<example>\nThis is a properly closed XML tag in markdown.\n</example>",
      "bad_example": "<example>\nThis XML tag is never closed and will confuse the parser."
    },
    {
      "id": "XML-002",
      "name": "Mismatched Closing Tag",
      "severity": "HIGH",
      "category": "xml",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://www.w3.org/TR/xml/"
        ],
        "verified_on": "2026-02-04",
        "applies_to": {},
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "unsafe"
      },
      "good_example": "<outer>\n<inner>\nContent here.\n</inner>\n</outer>",
      "bad_example": "<outer>\n<inner>\nContent here.\n</outer>\n</inner>"
    },
    {
      "id": "XML-003",
      "name": "Unmatched Closing Tag",
      "severity": "HIGH",
      "category": "xml",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://www.w3.org/TR/xml/"
        ],
        "verified_on": "2026-02-04",
        "applies_to": {},
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "unsafe"
      },
      "good_example": "<instructions>\nFollow these guidelines.\n</instructions>",
      "bad_example": "Follow these guidelines.\n</instructions>"
    },
    {
      "id": "XP-001",
      "name": "Platform-Specific Feature in Generic Config",
      "severity": "HIGH",
      "category": "cross-platform",
      "evidence": {
        "source_type": "community",
        "source_urls": [
          "https://developers.openai.com/codex/guides/agents-md",
          "https://cursor.com/docs/rules"
        ],
        "verified_on": "2026-02-04",
        "applies_to": {},
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "# Project Guidelines\n\nFollow the coding style guide.\n\n## Commands\n- npm run build\n- npm run test",
      "bad_example": "# Project Guidelines\n\n---\ncontext: fork\nagent: reviewer\nallowed-tools: Read Write\n---\n\n- type: PreToolExecution\n  command: echo \"lint\""
    },
    {
      "id": "XP-002",
      "name": "AGENTS.md Platform Compatibility",
      "severity": "MEDIUM",
      "category": "cross-platform",
      "evidence": {
        "source_type": "community",
        "source_urls": [
          "https://developers.openai.com/codex/guides/agents-md",
          "https://opencode.ai/docs/rules",
          "https://cursor.com/docs/rules",
          "https://docs.cline.bot/prompting/cline-memory-bank#cline-memory-bank-custom-instructions-[copy-this]",
          "https://github.blog/changelog/2025-08-28-copilot-coding-agent-now-supports-agents-md-custom-instructions/"
        ],
        "verified_on": "2026-02-09",
        "applies_to": {},
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "# Project Memory\n\n## Build Commands\n\n### Testing\n\nRun tests with npm test.",
      "bad_example": "Just plain text without any markdown headers or structure."
    },
    {
      "id": "XP-003",
      "name": "Hard-Coded Platform Paths",
      "severity": "MEDIUM",
      "category": "cross-platform",
      "evidence": {
        "source_type": "community",
        "source_urls": [
          "https://developers.openai.com/codex/guides/agents-md",
          "https://cursor.com/docs/rules"
        ],
        "verified_on": "2026-02-04",
        "applies_to": {},
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "# Configuration\n\nUse environment variables for all platform-specific settings.\nSee ./src/config.ts for defaults.",
      "bad_example": "# Configuration\n\n- Claude: .claude/settings.json\n- Cursor: .cursor/rules/\n- Config: ~/.config/my-tool/config.yaml"
    },
    {
      "id": "XP-004",
      "name": "Conflicting Build/Test Commands",
      "severity": "MEDIUM",
      "category": "cross-platform",
      "evidence": {
        "source_type": "community",
        "source_urls": [
          "https://developers.openai.com/codex/guides/agents-md",
          "https://cursor.com/docs/rules"
        ],
        "verified_on": "2026-02-04",
        "applies_to": {},
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "# CLAUDE.md\n\n## Commands\n- `npm install`\n- `npm run build`\n- `npm test`\n\n# AGENTS.md (separate file, same project)\n\n## Commands\n- `npm install`\n- `npm run build`\n- `npm test`",
      "bad_example": "# CLAUDE.md\n\n## Commands\n- `npm install`\n- `npm run build`\n- `npm run test`\n\n# AGENTS.md (separate file, same project)\n\n## Commands\n- `pnpm install`\n- `pnpm build`\n- `pnpm test`"
    },
    {
      "id": "XP-005",
      "name": "Conflicting Tool Constraints",
      "severity": "HIGH",
      "category": "cross-platform",
      "evidence": {
        "source_type": "community",
        "source_urls": [
          "https://developers.openai.com/codex/guides/agents-md",
          "https://cursor.com/docs/rules"
        ],
        "verified_on": "2026-02-04",
        "applies_to": {},
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "# CLAUDE.md\n\nallowed-tools: Read Write Edit Bash Grep\n\n# AGENTS.md (separate file, same project)\n\nallowed-tools: Read Write Edit Bash Grep",
      "bad_example": "# CLAUDE.md\n\nallowed-tools: Read Write Edit Bash Grep\nYou can use Bash for git operations.\n\n# AGENTS.md (separate file, same project)\n\nNever use Bash for any operations.\nDo not use Edit or Write tools."
    },
    {
      "id": "XP-006",
      "name": "Multiple Layers Without Documented Precedence",
      "severity": "MEDIUM",
      "category": "cross-platform",
      "evidence": {
        "source_type": "community",
        "source_urls": [
          "https://developers.openai.com/codex/guides/agents-md",
          "https://cursor.com/docs/rules"
        ],
        "verified_on": "2026-02-04",
        "applies_to": {},
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "# CLAUDE.md\n\nCLAUDE.md takes precedence over AGENTS.md.\n\n## Code Style\n- Use TypeScript\n- Follow ESLint rules",
      "bad_example": "# CLAUDE.md\n\n## Code Style\n- Use TypeScript\n- Follow ESLint rules\n\n# AGENTS.md (separate file, same project)\n\n## Code Style\n- Use JavaScript\n- Follow Prettier rules"
    },
    {
      "id": "XP-007",
      "name": "AGENTS.md Exceeds Codex Byte Limit",
      "description": "Codex CLI has a default project_doc_max_bytes limit of 32768 bytes for AGENTS.md. Files exceeding this limit will be silently truncated.",
      "severity": "MEDIUM",
      "category": "cross-platform",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://developers.openai.com/codex/guides/agents-md"
        ],
        "verified_on": "2025-05-01",
        "applies_to": {
          "tool": "codex"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "# AGENTS.md\n\n## Overview\nConcise project instructions under 32KB.\n\n## Commands\n- npm run build\n- npm run test",
      "bad_example": "# AGENTS.md\n\n(content exceeding 32768 bytes - will be truncated by Codex CLI)"
    },
    {
      "id": "XP-008",
      "name": "Claude-specific Features in CLAUDE.md for Cursor",
      "description": "CLAUDE.md contains Claude-specific features that Cursor cannot interpret. When using Cursor as the target tool, Claude-specific directives like context:fork, agent fields, and allowed-tools will be ignored.",
      "severity": "MEDIUM",
      "category": "cross-platform",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://docs.cursor.com/context/rules-for-ai"
        ],
        "verified_on": "2026-02-21",
        "applies_to": {
          "tool": "cursor"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": false,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "# CLAUDE.md\n\n## Claude Code\n\ncontext: fork\nagent: reviewer\n\n## General\n\nKeep code clean and well-tested.",
      "bad_example": "# CLAUDE.md\n\ncontext: fork\nagent: reviewer\nallowed-tools: Read Write"
    },
    {
      "id": "XP-SK-001",
      "name": "Skill Uses Client-Specific Features",
      "severity": "LOW",
      "category": "cross-platform",
      "evidence": {
        "source_type": "community",
        "source_urls": [
          "https://agentskills.io/specification"
        ],
        "verified_on": "2026-02-07",
        "applies_to": {},
        "normative_level": "BEST_PRACTICE",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "---\nname: code-review\ndescription: Reviews code for quality issues\n---\nReview the code for bugs and style issues.",
      "bad_example": "---\nname: code-review\ndescription: Reviews code for quality issues\nmodel: opus\ncontext: fork\nagent: general-purpose\n---\nReview the code for bugs and style issues."
    },
    {
      "id": "OC-CFG-001",
      "name": "Invalid Model Format",
      "severity": "HIGH",
      "category": "opencode",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://opencode.ai/docs/config"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "opencode"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"model\": \"anthropic/claude-3-opus\"\n}",
      "bad_example": "{\n  \"model\": \"claude-3-opus\"\n}"
    },
    {
      "id": "OC-CFG-002",
      "name": "Invalid autoupdate value",
      "severity": "HIGH",
      "category": "opencode",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://opencode.ai/docs/config"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "opencode"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"autoupdate\": \"notify\"\n}",
      "bad_example": "{\n  \"autoupdate\": \"yes\"\n}"
    },
    {
      "id": "OC-CFG-003",
      "name": "Unknown Top-level Config Field",
      "severity": "MEDIUM",
      "category": "opencode",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://opencode.ai/docs/config"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "opencode"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"model\": \"anthropic/claude-3-opus\",\n  \"share\": \"manual\"\n}",
      "bad_example": "{\n  \"mdoel\": \"anthropic/claude-3-opus\"\n}"
    },
    {
      "id": "OC-CFG-004",
      "name": "Invalid Default Agent",
      "severity": "MEDIUM",
      "category": "opencode",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://opencode.ai/docs/config"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "opencode"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"default_agent\": \"build\"\n}",
      "bad_example": "{\n  \"default_agent\": \"unknown-agent\"\n}"
    },
    {
      "id": "OC-CFG-005",
      "name": "Hardcoded API Key",
      "severity": "HIGH",
      "category": "opencode",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://opencode.ai/docs/config"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "opencode"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"provider\": { \"options\": { \"apiKey\": \"{env:OPENAI_API_KEY}\" } }\n}",
      "bad_example": "{\n  \"provider\": { \"options\": { \"apiKey\": \"sk-1234567890abcdef\" } }\n}"
    },
    {
      "id": "OC-CFG-006",
      "name": "Invalid MCP Server Structure",
      "severity": "HIGH",
      "category": "opencode",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://opencode.ai/docs/config"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "opencode"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"mcp\": { \"server\": { \"type\": \"local\", \"command\": [\"node\"] } }\n}",
      "bad_example": "{\n  \"mcp\": { \"server\": { \"type\": \"invalid\" } }\n}"
    },
    {
      "id": "OC-CFG-007",
      "name": "Invalid MCP Server Command, URL, or cwd",
      "severity": "HIGH",
      "category": "opencode",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://opencode.ai/docs/config",
          "https://github.com/sst/opencode/pull/30676"
        ],
        "verified_on": "2026-06-16",
        "applies_to": {
          "tool": "opencode"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"mcp\": { \"server\": { \"type\": \"local\", \"command\": [\"node\"], \"cwd\": \"plugins/sub\" } }\n}",
      "bad_example": "{\n  \"mcp\": { \"server\": { \"type\": \"local\", \"command\": [\"node\"], \"cwd\": 42 } }\n}"
    },
    {
      "id": "OC-AG-001",
      "name": "Invalid Agent Mode Value",
      "severity": "HIGH",
      "category": "opencode",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://opencode.ai/docs/config"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "opencode"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"agent\": { \"custom\": { \"mode\": \"subagent\" } }\n}",
      "bad_example": "{\n  \"agent\": { \"custom\": { \"mode\": \"invalid\" } }\n}"
    },
    {
      "id": "OC-AG-002",
      "name": "Invalid Color Format",
      "severity": "HIGH",
      "category": "opencode",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://opencode.ai/docs/config"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "opencode"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"agent\": { \"custom\": { \"color\": \"#ff0000\" } }\n}",
      "bad_example": "{\n  \"agent\": { \"custom\": { \"color\": \"red\" } }\n}"
    },
    {
      "id": "OC-AG-003",
      "name": "Temperature Out of Range",
      "severity": "HIGH",
      "category": "opencode",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://opencode.ai/docs/config"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "opencode"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"agent\": { \"custom\": { \"temperature\": 0.7 } }\n}",
      "bad_example": "{\n  \"agent\": { \"custom\": { \"temperature\": 3.5 } }\n}"
    },
    {
      "id": "OC-AG-004",
      "name": "Steps Not a Positive Integer",
      "severity": "HIGH",
      "category": "opencode",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://opencode.ai/docs/config"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "opencode"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"agent\": { \"custom\": { \"steps\": 50 } }\n}",
      "bad_example": "{\n  \"agent\": { \"custom\": { \"steps\": -5 } }\n}"
    },
    {
      "id": "OC-PM-001",
      "name": "Invalid Permission Action",
      "severity": "HIGH",
      "category": "opencode",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://opencode.ai/docs/config"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "opencode"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"permission\": { \"read\": \"allow\", \"bash\": \"ask\" }\n}",
      "bad_example": "{\n  \"permission\": { \"read\": \"yes\" }\n}"
    },
    {
      "id": "OC-PM-002",
      "name": "Unknown Permission Key",
      "severity": "MEDIUM",
      "category": "opencode",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://opencode.ai/docs/config"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "opencode"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"permission\": { \"read\": \"allow\" }\n}",
      "bad_example": "{\n  \"permission\": { \"unknown\": \"allow\" }\n}"
    },
    {
      "id": "OC-AGM-001",
      "name": "Empty AGENTS.md",
      "severity": "HIGH",
      "category": "opencode",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://opencode.ai/docs/config"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "opencode"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "# AGENTS\n\nSome content.",
      "bad_example": ""
    },
    {
      "id": "OC-AGM-002",
      "name": "Secrets in AGENTS.md",
      "severity": "HIGH",
      "category": "opencode",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://opencode.ai/docs/config"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "opencode"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "# AGENTS\n\nUse environment variables.",
      "bad_example": "# AGENTS\n\nAPI_KEY=sk-123456"
    },
    {
      "id": "OC-DEP-001",
      "name": "Deprecated mode Field",
      "severity": "MEDIUM",
      "category": "opencode",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://opencode.ai/docs/config"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "opencode"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe"
      },
      "good_example": "{\n  \"agent\": { \"my-agent\": {} }\n}",
      "bad_example": "{\n  \"mode\": \"agent\"\n}"
    },
    {
      "id": "OC-DEP-002",
      "name": "Deprecated tools Field",
      "severity": "MEDIUM",
      "category": "opencode",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://opencode.ai/docs/config"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "opencode"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe"
      },
      "good_example": "{\n  \"permission\": { \"read\": \"allow\" }\n}",
      "bad_example": "{\n  \"tools\": {}\n}"
    },
    {
      "id": "OC-DEP-003",
      "name": "Deprecated autoshare Field",
      "severity": "MEDIUM",
      "category": "opencode",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://opencode.ai/docs/config"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "opencode"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe"
      },
      "good_example": "{\n  \"share\": \"manual\"\n}",
      "bad_example": "{\n  \"autoshare\": \"manual\"\n}"
    },
    {
      "id": "OC-DEP-004",
      "name": "Deprecated CONTEXT.md Filename",
      "severity": "MEDIUM",
      "category": "opencode",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://opencode.ai/docs/config"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "opencode"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": false,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "AGENTS.md",
      "bad_example": "CONTEXT.md"
    },
    {
      "id": "OC-DEP-005",
      "name": "Deprecated TUI Keys",
      "severity": "MEDIUM",
      "category": "opencode",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://opencode.ai/docs/"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "opencode"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": false,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"tui\": { \"theme\": \"dark\" }\n}",
      "bad_example": "{\n  \"tui\": { \"colors\": { \"bg\": \"#000\" } }\n}"
    },
    {
      "id": "OC-DEP-006",
      "name": "Deprecated MaxSteps Field",
      "severity": "MEDIUM",
      "category": "opencode",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://opencode.ai/docs/"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "opencode"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": false,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "safe"
      },
      "good_example": "{\n  \"agent\": { \"a\": { \"maxTokens\": 8000 } }\n}",
      "bad_example": "{\n  \"agent\": { \"a\": { \"maxSteps\": 50 } }\n}"
    },
    {
      "id": "OC-CFG-008",
      "name": "Invalid Log Level",
      "severity": "HIGH",
      "category": "opencode",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://opencode.ai/docs/config"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "opencode"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "unsafe"
      },
      "good_example": "{\n  \"logLevel\": \"info\"\n}",
      "bad_example": "{\n  \"logLevel\": \"verbose\"\n}"
    },
    {
      "id": "OC-CFG-009",
      "name": "Invalid Compaction Reserved",
      "severity": "HIGH",
      "category": "opencode",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://opencode.ai/docs/config"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "opencode"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"compaction\": { \"reserved\": 5 }\n}",
      "bad_example": "{\n  \"compaction\": { \"reserved\": -1 }\n}"
    },
    {
      "id": "OC-CFG-010",
      "name": "Invalid Skills URL",
      "severity": "HIGH",
      "category": "opencode",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://opencode.ai/docs/config"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "opencode"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"skills\": { \"urls\": [\"https://example.com\"] }\n}",
      "bad_example": "{\n  \"skills\": { \"urls\": [\"not-a-url\"] }\n}"
    },
    {
      "id": "OC-CFG-011",
      "name": "Invalid MCP Timeout",
      "severity": "HIGH",
      "category": "opencode",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://opencode.ai/docs/config"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "opencode"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"mcp\": { \"srv\": { \"timeout\": 5000 } }\n}",
      "bad_example": "{\n  \"mcp\": { \"srv\": { \"timeout\": -5 } }\n}"
    },
    {
      "id": "OC-CFG-012",
      "name": "Invalid MCP OAuth Config",
      "severity": "HIGH",
      "category": "opencode",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://opencode.ai/docs/config"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "opencode"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"mcp\": { \"srv\": { \"oauth\": { \"client_id\": \"abc\", \"authorization_url\": \"https://auth.example.com\" } } }\n}",
      "bad_example": "{\n  \"mcp\": { \"srv\": { \"oauth\": { \"client_id\": \"abc\" } } }\n}"
    },
    {
      "id": "OC-CFG-013",
      "name": "Invalid Server Config",
      "severity": "HIGH",
      "category": "opencode",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://opencode.ai/docs/"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "opencode"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": false,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"mcp\": { \"srv\": { \"type\": \"stdio\", \"command\": \"node server.js\" } }\n}",
      "bad_example": "{\n  \"mcp\": { \"srv\": { \"type\": \"invalid\" } }\n}"
    },
    {
      "id": "OC-AG-005",
      "name": "top_p Out of Range",
      "severity": "HIGH",
      "category": "opencode",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://opencode.ai/docs/config"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "opencode"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"agent\": { \"a\": { \"top_p\": 0.9 } }\n}",
      "bad_example": "{\n  \"agent\": { \"a\": { \"top_p\": 1.5 } }\n}"
    },
    {
      "id": "OC-AG-006",
      "name": "Invalid Named Color",
      "severity": "MEDIUM",
      "category": "opencode",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://opencode.ai/docs/config"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "opencode"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "unsafe"
      },
      "good_example": "{\n  \"agent\": { \"a\": { \"color\": \"primary\" } }\n}",
      "bad_example": "{\n  \"agent\": { \"a\": { \"color\": \"purple\" } }\n}"
    },
    {
      "id": "OC-AG-007",
      "name": "Redundant steps and maxSteps",
      "severity": "MEDIUM",
      "category": "opencode",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://opencode.ai/docs/config"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "opencode"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"agent\": { \"a\": { \"steps\": 20 } }\n}",
      "bad_example": "{\n  \"agent\": { \"a\": { \"steps\": 10, \"maxSteps\": 20 } }\n}"
    },
    {
      "id": "OC-AG-008",
      "name": "Invalid hidden Type",
      "severity": "HIGH",
      "category": "opencode",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://opencode.ai/docs/config"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "opencode"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"agent\": { \"a\": { \"hidden\": true } }\n}",
      "bad_example": "{\n  \"agent\": { \"a\": { \"hidden\": \"yes\" } }\n}"
    },
    {
      "id": "OC-AG-009",
      "name": "Invalid Agent Disable Type",
      "severity": "HIGH",
      "category": "opencode",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://opencode.ai/docs/"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "opencode"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": false,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "unsafe"
      },
      "good_example": "{\n  \"agent\": { \"a\": { \"disabled\": true } }\n}",
      "bad_example": "{\n  \"agent\": { \"a\": { \"disabled\": \"yes\" } }\n}"
    },
    {
      "id": "OC-LSP-001",
      "name": "LSP Command Without Extensions",
      "severity": "MEDIUM",
      "category": "opencode",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://opencode.ai/docs/config"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "opencode"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"lsp\": { \"ts\": { \"command\": \"tsc\", \"extensions\": [\".ts\"] } }\n}",
      "bad_example": "{\n  \"lsp\": { \"ts\": { \"command\": \"tsc\" } }\n}"
    },
    {
      "id": "OC-LSP-002",
      "name": "Invalid LSP Extensions",
      "severity": "HIGH",
      "category": "opencode",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://opencode.ai/docs/config"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "opencode"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"lsp\": { \"ts\": { \"extensions\": [\".ts\", \".tsx\"] } }\n}",
      "bad_example": "{\n  \"lsp\": { \"ts\": { \"extensions\": [] } }\n}"
    },
    {
      "id": "OC-TUI-001",
      "name": "Unknown TUI Key",
      "severity": "MEDIUM",
      "category": "opencode",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://opencode.ai/docs/config"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "opencode"
        },
        "normative_level": "SHOULD",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"tui\": { \"theme\": \"dark\" }\n}",
      "bad_example": "{\n  \"tui\": { \"unknown_opt\": true }\n}"
    },
    {
      "id": "OC-TUI-002",
      "name": "Invalid scroll_speed",
      "severity": "HIGH",
      "category": "opencode",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://opencode.ai/docs/config"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "opencode"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": false
      },
      "good_example": "{\n  \"tui\": { \"scroll_speed\": 1.0 }\n}",
      "bad_example": "{\n  \"tui\": { \"scroll_speed\": 0.0001 }\n}"
    },
    {
      "id": "OC-TUI-003",
      "name": "Invalid diff_style",
      "severity": "HIGH",
      "category": "opencode",
      "evidence": {
        "source_type": "vendor_docs",
        "source_urls": [
          "https://opencode.ai/docs/config"
        ],
        "verified_on": "2026-04-23",
        "applies_to": {
          "tool": "opencode"
        },
        "normative_level": "MUST",
        "tests": {
          "unit": true,
          "fixtures": true,
          "e2e": false
        }
      },
      "fix": {
        "autofix": true,
        "fix_safety": "unsafe"
      },
      "good_example": "{\n  \"tui\": { \"diff_style\": \"auto\" }\n}",
      "bad_example": "{\n  \"tui\": { \"diff_style\": \"unified\" }\n}"
    }
  ],
  "categories": {
    "agent-skills": {
      "prefix": "AS",
      "count": 14,
      "description": "Agent Skills specification rules"
    },
    "claude-skills": {
      "prefix": "CC-SK",
      "count": 21,
      "description": "Claude Code Skills rules"
    },
    "claude-hooks": {
      "prefix": "CC-HK",
      "count": 27,
      "description": "Claude Code Hooks rules"
    },
    "claude-agents": {
      "prefix": "CC-AG",
      "count": 17,
      "description": "Claude Code Subagents rules"
    },
    "claude-memory": {
      "prefix": "CC-MEM",
      "count": 13,
      "description": "Claude Code Memory rules"
    },
    "claude-output-styles": {
      "prefix": "CC-OS",
      "count": 6,
      "description": "Claude Code Output Styles rules"
    },
    "agents-md": {
      "prefix": "AGM",
      "count": 6,
      "description": "AGENTS.md cross-platform rules"
    },
    "claude-plugins": {
      "prefix": "CC-PL",
      "count": 15,
      "description": "Claude Code Plugins rules"
    },
    "mcp": {
      "prefix": "MCP",
      "count": 26,
      "description": "Model Context Protocol rules"
    },
    "copilot": {
      "prefix": "COP",
      "count": 25,
      "description": "GitHub Copilot rules"
    },
    "cursor": {
      "prefix": "CUR",
      "count": 19,
      "description": "Cursor project rules"
    },
    "cline": {
      "prefix": "CLN",
      "count": 7,
      "description": "Cline rules validation"
    },
    "opencode": {
      "prefix": "OC",
      "count": 45,
      "description": "OpenCode configuration rules"
    },
    "gemini-cli": {
      "prefix": "GM",
      "count": 10,
      "description": "Gemini CLI instruction file rules"
    },
    "codex": {
      "prefix": "CDX",
      "count": 63,
      "description": "Codex CLI configuration validation"
    },
    "roo-code": {
      "prefix": "ROO",
      "count": 6,
      "description": "Roo Code rules and configuration validation"
    },
    "xml": {
      "prefix": "XML",
      "count": 3,
      "description": "XML validation rules"
    },
    "references": {
      "prefix": "REF",
      "count": 4,
      "description": "Reference/import validation rules"
    },
    "prompt-engineering": {
      "prefix": "PE",
      "count": 6,
      "description": "Prompt engineering rules"
    },
    "cross-platform": {
      "prefix": "XP",
      "count": 9,
      "description": "Cross-platform compatibility rules"
    },
    "cursor-skills": {
      "prefix": "CR-SK",
      "count": 1,
      "description": "Cursor per-client skill rules"
    },
    "cline-skills": {
      "prefix": "CL-SK",
      "count": 3,
      "description": "Cline per-client skill rules"
    },
    "copilot-skills": {
      "prefix": "CP-SK",
      "count": 1,
      "description": "Copilot per-client skill rules"
    },
    "codex-skills": {
      "prefix": "CX-SK",
      "count": 1,
      "description": "Codex per-client skill rules"
    },
    "opencode-skills": {
      "prefix": "OC-SK",
      "count": 1,
      "description": "OpenCode per-client skill rules"
    },
    "windsurf-skills": {
      "prefix": "WS-SK",
      "count": 1,
      "description": "Windsurf per-client skill rules"
    },
    "windsurf": {
      "prefix": "WS",
      "count": 4,
      "description": "Windsurf rules, workflows, and legacy file validation"
    },
    "kiro-skills": {
      "prefix": "KR-SK",
      "count": 1,
      "description": "Kiro per-client skill rules"
    },
    "kiro-agents": {
      "prefix": "KR-AG",
      "count": 13,
      "description": "Kiro agent configuration and invocation rules"
    },
    "amp-skills": {
      "prefix": "AMP-SK",
      "count": 1,
      "description": "Amp per-client skill rules"
    },
    "roo-code-skills": {
      "prefix": "RC-SK",
      "count": 1,
      "description": "Roo Code per-client skill rules"
    },
    "version-awareness": {
      "prefix": "VER",
      "count": 1,
      "description": "Version-aware validation rules"
    },
    "amp-checks": {
      "prefix": "AMP",
      "count": 4,
      "description": "Amp code review checks and settings rules"
    },
    "kiro-steering": {
      "prefix": "KIRO",
      "count": 14,
      "description": "Kiro steering file validation rules"
    },
    "kiro-hooks": {
      "prefix": "KR-HK",
      "count": 10,
      "description": "Kiro IDE and CLI hook rules"
    },
    "kiro-mcp": {
      "prefix": "KR-MCP",
      "count": 6,
      "description": "Kiro MCP configuration rules"
    },
    "kiro-powers": {
      "prefix": "KR-PW",
      "count": 8,
      "description": "Kiro power configuration rules"
    },
    "kiro-settings": {
      "prefix": "KR-SET",
      "count": 3,
      "description": "Kiro CLI settings (.kiro/settings.json) rules"
    },
    "claude-settings": {
      "prefix": "CC-SET",
      "count": 9,
      "description": "Claude Code settings (.claude/settings.json) rules"
    },
    "gemini-agents": {
      "prefix": "GM-AG",
      "count": 1,
      "description": "Gemini CLI local agent (.gemini/agents/*.md) rules"
    }
  },
  "authoring": {
    "version": "1.0.0",
    "families": [
      {
        "id": "skill",
        "keys": [
          {
            "key": "name",
            "docs": "Skill identifier in kebab-case. Must be unique and stable.",
            "rules": [
              "AS-002",
              "AS-004",
              "AS-005",
              "AS-006",
              "AS-017"
            ],
            "values": [],
            "snippet": "name: my-skill"
          },
          {
            "key": "description",
            "docs": "Describe when to use the skill. Include a clear trigger phrase.",
            "rules": [
              "AS-003",
              "AS-008"
            ],
            "values": [],
            "snippet": "description: Use when user wants to ..."
          },
          {
            "key": "allowed-tools",
            "docs": "Comma-separated tool allowlist. Restrict scope for safety. MCP tools use mcp__ prefix.",
            "rules": [
              "CC-SK-007",
              "CC-SK-008"
            ],
            "values": [
              "Read",
              "Write",
              "Edit",
              "Bash(git:*)",
              "Grep",
              "Glob",
              "Task",
              "WebFetch",
              "WebSearch",
              "AskUserQuestion",
              "TodoRead",
              "TodoWrite",
              "MultiTool",
              "NotebookEdit",
              "EnterPlanMode",
              "ExitPlanMode",
              "Skill",
              "StatusBarMessageTool",
              "SendMessageTool",
              "TaskOutput"
            ],
            "snippet": "allowed-tools: Read, Grep, Bash(git:*)"
          },
          {
            "key": "argument-hint",
            "docs": "Optional hint shown to users for skill arguments.",
            "rules": [
              "CC-SK-012",
              "CC-SK-016"
            ],
            "values": [],
            "snippet": "argument-hint: path/to/file"
          },
          {
            "key": "disable-model-invocation",
            "docs": "Disable automatic model invocation for dangerous or manual workflows.",
            "rules": [
              "CC-SK-006"
            ],
            "values": [
              "true",
              "false"
            ],
            "snippet": "disable-model-invocation: true"
          },
          {
            "key": "user-invocable",
            "docs": "Whether users can invoke this skill directly.",
            "rules": [
              "CC-SK-015",
              "CC-SK-011"
            ],
            "values": [
              "true",
              "false"
            ],
            "snippet": "user-invocable: true"
          },
          {
            "key": "model",
            "docs": "Optional Claude model override.",
            "rules": [
              "CC-SK-001"
            ],
            "values": [
              "sonnet",
              "opus",
              "haiku",
              "inherit"
            ],
            "snippet": "model: sonnet"
          },
          {
            "key": "context",
            "docs": "Execution context mode for sub-agent usage.",
            "rules": [
              "CC-SK-002",
              "CC-SK-003",
              "CC-SK-004"
            ],
            "values": [
              "fork"
            ],
            "snippet": "context: fork"
          },
          {
            "key": "agent",
            "docs": "Optional agent to run when context is fork.",
            "rules": [
              "CC-SK-003",
              "CC-SK-004",
              "CC-SK-005"
            ],
            "values": [
              "Explore",
              "Plan",
              "general-purpose"
            ],
            "snippet": "agent: general-purpose"
          },
          {
            "key": "compatibility",
            "docs": "Optional compatibility notes for tools or versions.",
            "rules": [
              "AS-011"
            ],
            "values": [],
            "snippet": "compatibility: Claude Code >= 1.0"
          },
          {
            "key": "license",
            "docs": "Optional license identifier for the skill package.",
            "rules": [
              "AS-016"
            ],
            "values": [],
            "snippet": "license: MIT"
          },
          {
            "key": "metadata",
            "docs": "Optional metadata map for additional machine-readable hints.",
            "rules": [
              "AS-016"
            ],
            "values": [],
            "snippet": "metadata:\n  owner: team-platform"
          }
        ],
        "snippets": [
          {
            "label": "SKILL frontmatter",
            "body": "---\nname: my-skill\ndescription: Use when user wants to ...\nmodel: sonnet\nallowed-tools: Read, Grep\n---\n",
            "docs": "Base SKILL.md frontmatter scaffold.",
            "rules": [
              "AS-001",
              "AS-002",
              "AS-003"
            ]
          }
        ]
      },
      {
        "id": "agent",
        "keys": [
          {
            "key": "name",
            "docs": "Agent identifier.",
            "rules": [
              "CC-AG-001"
            ],
            "values": [],
            "snippet": "name: my-agent"
          },
          {
            "key": "description",
            "docs": "Explain what this agent does.",
            "rules": [
              "CC-AG-002"
            ],
            "values": [],
            "snippet": "description: Handles focused tasks"
          },
          {
            "key": "tools",
            "docs": "Allowed tools for this agent. MCP tools use mcp__ prefix.",
            "rules": [
              "CC-AG-006",
              "CC-AG-009"
            ],
            "values": [
              "Read",
              "Write",
              "Edit",
              "Bash",
              "Grep",
              "Glob",
              "Task",
              "WebFetch",
              "WebSearch",
              "AskUserQuestion",
              "TodoRead",
              "TodoWrite",
              "MultiTool",
              "NotebookEdit",
              "EnterPlanMode",
              "ExitPlanMode",
              "Skill",
              "StatusBarMessageTool",
              "SendMessageTool",
              "TaskOutput"
            ],
            "snippet": "tools:\n  - Read\n  - Grep"
          },
          {
            "key": "disallowedTools",
            "docs": "Tools this agent must never use. MCP tools use mcp__ prefix.",
            "rules": [
              "CC-AG-006",
              "CC-AG-010"
            ],
            "values": [
              "Bash",
              "Read",
              "Write",
              "Edit",
              "Grep",
              "Glob",
              "Task",
              "WebFetch",
              "WebSearch",
              "AskUserQuestion",
              "TodoRead",
              "TodoWrite",
              "MultiTool",
              "NotebookEdit",
              "EnterPlanMode",
              "ExitPlanMode",
              "Skill",
              "StatusBarMessageTool",
              "SendMessageTool",
              "TaskOutput"
            ],
            "snippet": "disallowedTools:\n  - Bash"
          },
          {
            "key": "model",
            "docs": "Model selection for this agent.",
            "rules": [
              "CC-AG-003"
            ],
            "values": [
              "sonnet",
              "opus",
              "haiku",
              "inherit"
            ],
            "snippet": "model: sonnet"
          },
          {
            "key": "permissionMode",
            "docs": "Permission interaction policy.",
            "rules": [
              "CC-AG-004",
              "CC-AG-012"
            ],
            "values": [
              "default",
              "acceptEdits",
              "dontAsk",
              "bypassPermissions",
              "plan",
              "delegate"
            ],
            "snippet": "permissionMode: default"
          },
          {
            "key": "skills",
            "docs": "Preloaded skills for this agent.",
            "rules": [
              "CC-AG-005",
              "CC-AG-013"
            ],
            "values": [],
            "snippet": "skills:\n  - code-review"
          },
          {
            "key": "memory",
            "docs": "Memory scope for this agent.",
            "rules": [
              "CC-AG-008"
            ],
            "values": [
              "user",
              "project",
              "local"
            ],
            "snippet": "memory: project"
          },
          {
            "key": "hooks",
            "docs": "Hook configuration for agent lifecycle.",
            "rules": [
              "CC-AG-007",
              "CC-AG-011"
            ],
            "values": [],
            "snippet": "hooks: {}"
          }
        ],
        "snippets": [
          {
            "label": "Agent frontmatter",
            "body": "---\nname: my-agent\ndescription: Handles focused tasks\nmodel: sonnet\npermissionMode: default\n---\n",
            "docs": "Base Claude sub-agent frontmatter scaffold.",
            "rules": [
              "CC-AG-001",
              "CC-AG-002",
              "CC-AG-003",
              "CC-AG-004"
            ]
          }
        ]
      },
      {
        "id": "hooks",
        "keys": [
          {
            "key": "hooks",
            "docs": "Root hooks object keyed by event name.",
            "rules": [
              "CC-HK-001"
            ],
            "values": [],
            "snippet": "\"hooks\": {}"
          },
          {
            "key": "matcher",
            "docs": "Matcher for tool events only.",
            "rules": [
              "CC-HK-003",
              "CC-HK-004"
            ],
            "values": [
              "*",
              "Bash",
              "Read",
              "Write"
            ],
            "snippet": "\"matcher\": \"*\""
          },
          {
            "key": "type",
            "docs": "Hook type.",
            "rules": [
              "CC-HK-005"
            ],
            "values": [
              "command",
              "prompt"
            ],
            "snippet": "\"type\": \"command\""
          },
          {
            "key": "command",
            "docs": "Shell command to execute for command hooks.",
            "rules": [
              "CC-HK-006",
              "CC-HK-009"
            ],
            "values": [],
            "snippet": "\"command\": \"echo hello\""
          },
          {
            "key": "prompt",
            "docs": "Prompt template for prompt hooks.",
            "rules": [
              "CC-HK-002",
              "CC-HK-007"
            ],
            "values": [],
            "snippet": "\"prompt\": \"Summarize this change\""
          },
          {
            "key": "timeout",
            "docs": "Positive integer timeout in seconds.",
            "rules": [
              "CC-HK-010",
              "CC-HK-011"
            ],
            "values": [
              "30",
              "60",
              "600"
            ],
            "snippet": "\"timeout\": 30"
          }
        ],
        "snippets": [
          {
            "label": "Hooks matcher block",
            "body": "{\n  \"hooks\": {\n    \"PreToolUse\": [\n      {\n        \"matcher\": \"*\",\n        \"hooks\": [\n          {\n            \"type\": \"command\",\n            \"command\": \"echo hello\",\n            \"timeout\": 30\n          }\n        ]\n      }\n    ]\n  }\n}",
            "docs": "Starter hooks JSON structure.",
            "rules": [
              "CC-HK-001",
              "CC-HK-003",
              "CC-HK-005"
            ]
          }
        ]
      },
      {
        "id": "plugin",
        "keys": [
          {
            "key": "name",
            "docs": "Plugin name.",
            "rules": [
              "CC-PL-004",
              "CC-PL-005"
            ],
            "values": [],
            "snippet": "\"name\": \"my-plugin\""
          },
          {
            "key": "description",
            "docs": "Plugin description.",
            "rules": [
              "CC-PL-004"
            ],
            "values": [],
            "snippet": "\"description\": \"Plugin description\""
          },
          {
            "key": "version",
            "docs": "Semver version string.",
            "rules": [
              "CC-PL-003",
              "CC-PL-004"
            ],
            "values": [
              "1.0.0"
            ],
            "snippet": "\"version\": \"1.0.0\""
          },
          {
            "key": "author",
            "docs": "Author metadata object.",
            "rules": [
              "CC-PL-009"
            ],
            "values": [],
            "snippet": "\"author\": { \"name\": \"Your Name\" }"
          },
          {
            "key": "homepage",
            "docs": "Project homepage URL.",
            "rules": [
              "CC-PL-010"
            ],
            "values": [],
            "snippet": "\"homepage\": \"https://example.com\""
          },
          {
            "key": "repository",
            "docs": "Repository URL.",
            "rules": [
              "CC-PL-006"
            ],
            "values": [],
            "snippet": "\"repository\": \"https://github.com/org/repo\""
          },
          {
            "key": "license",
            "docs": "License identifier.",
            "rules": [
              "CC-PL-006"
            ],
            "values": [
              "MIT",
              "Apache-2.0"
            ],
            "snippet": "\"license\": \"MIT\""
          },
          {
            "key": "keywords",
            "docs": "Search/discovery keywords.",
            "rules": [
              "CC-PL-006"
            ],
            "values": [],
            "snippet": "\"keywords\": [\"agent\", \"linter\"]"
          }
        ],
        "snippets": [
          {
            "label": "Plugin manifest",
            "body": "{\n  \"name\": \"my-plugin\",\n  \"description\": \"Plugin description\",\n  \"version\": \"1.0.0\"\n}",
            "docs": "Starter plugin.json manifest.",
            "rules": [
              "CC-PL-004"
            ]
          }
        ]
      },
      {
        "id": "mcp",
        "keys": [
          {
            "key": "jsonrpc",
            "docs": "JSON-RPC protocol version.",
            "rules": [
              "MCP-001"
            ],
            "values": [
              "2.0"
            ],
            "snippet": "\"jsonrpc\": \"2.0\""
          },
          {
            "key": "protocolVersion",
            "docs": "MCP negotiated protocol version.",
            "rules": [
              "MCP-008"
            ],
            "values": [
              "2025-11-25"
            ],
            "snippet": "\"protocolVersion\": \"2025-11-25\""
          },
          {
            "key": "method",
            "docs": "JSON-RPC method name.",
            "rules": [
              "MCP-008"
            ],
            "values": [
              "initialize"
            ],
            "snippet": "\"method\": \"initialize\""
          },
          {
            "key": "id",
            "docs": "Request identifier.",
            "rules": [
              "MCP-007"
            ],
            "values": [
              "1"
            ],
            "snippet": "\"id\": 1"
          },
          {
            "key": "params",
            "docs": "Request parameters object.",
            "rules": [
              "MCP-008"
            ],
            "values": [],
            "snippet": "\"params\": {}"
          },
          {
            "key": "result",
            "docs": "Response result payload.",
            "rules": [
              "MCP-008"
            ],
            "values": [],
            "snippet": "\"result\": {}"
          },
          {
            "key": "error",
            "docs": "Response error payload.",
            "rules": [
              "MCP-007"
            ],
            "values": [],
            "snippet": "\"error\": {}"
          },
          {
            "key": "mcpServers",
            "docs": "MCP server map configuration.",
            "rules": [
              "MCP-007",
              "MCP-009",
              "MCP-010",
              "MCP-011",
              "MCP-012"
            ],
            "values": [],
            "snippet": "\"mcpServers\": {}"
          },
          {
            "key": "type",
            "docs": "MCP server transport type.",
            "rules": [
              "MCP-009",
              "MCP-010",
              "MCP-011",
              "MCP-012"
            ],
            "values": [
              "stdio",
              "http",
              "sse"
            ],
            "snippet": "\"type\": \"stdio\""
          },
          {
            "key": "command",
            "docs": "Command to launch a stdio MCP server.",
            "rules": [
              "MCP-009"
            ],
            "values": [],
            "snippet": "\"command\": \"node\""
          },
          {
            "key": "url",
            "docs": "Endpoint URL for http/sse MCP server.",
            "rules": [
              "MCP-010"
            ],
            "values": [],
            "snippet": "\"url\": \"http://localhost:3000/mcp\""
          },
          {
            "key": "tools",
            "docs": "Array of MCP tool definitions.",
            "rules": [
              "MCP-002"
            ],
            "values": [],
            "snippet": "\"tools\": []"
          },
          {
            "key": "name",
            "docs": "MCP tool name.",
            "rules": [
              "MCP-002"
            ],
            "values": [],
            "snippet": "\"name\": \"tool-name\""
          },
          {
            "key": "description",
            "docs": "MCP tool description.",
            "rules": [
              "MCP-002",
              "MCP-004"
            ],
            "values": [],
            "snippet": "\"description\": \"Describe what this tool does\""
          },
          {
            "key": "inputSchema",
            "docs": "JSON Schema for tool inputs.",
            "rules": [
              "MCP-002",
              "MCP-003"
            ],
            "values": [],
            "snippet": "\"inputSchema\": { \"type\": \"object\", \"properties\": {} }"
          },
          {
            "key": "requiresApproval",
            "docs": "Whether user approval is required before tool execution.",
            "rules": [
              "MCP-005"
            ],
            "values": [
              "true",
              "false"
            ],
            "snippet": "\"requiresApproval\": true"
          },
          {
            "key": "confirmation",
            "docs": "Human-facing confirmation prompt.",
            "rules": [
              "MCP-005"
            ],
            "values": [],
            "snippet": "\"confirmation\": \"Are you sure?\""
          },
          {
            "key": "annotations",
            "docs": "Optional metadata annotations (treat as untrusted).",
            "rules": [
              "MCP-006"
            ],
            "values": [],
            "snippet": "\"annotations\": {}"
          }
        ],
        "snippets": [
          {
            "label": "MCP initialize request",
            "body": "{\n  \"jsonrpc\": \"2.0\",\n  \"id\": 1,\n  \"method\": \"initialize\",\n  \"params\": {\n    \"protocolVersion\": \"2025-11-25\"\n  }\n}",
            "docs": "Initialize request scaffold.",
            "rules": [
              "MCP-001",
              "MCP-008"
            ]
          },
          {
            "label": "MCP tool",
            "body": "{\n  \"name\": \"tool-name\",\n  \"description\": \"Describe what this tool does\",\n  \"inputSchema\": {\n    \"type\": \"object\",\n    \"properties\": {}\n  },\n  \"requiresApproval\": true\n}",
            "docs": "Tool definition scaffold.",
            "rules": [
              "MCP-002",
              "MCP-003",
              "MCP-005"
            ]
          },
          {
            "label": "MCP stdio server",
            "body": "{\n  \"mcpServers\": {\n    \"server-name\": {\n      \"type\": \"stdio\",\n      \"command\": \"node\",\n      \"args\": [\"server.js\"]\n    }\n  }\n}",
            "docs": "Stdio server configuration scaffold.",
            "rules": [
              "MCP-009",
              "MCP-011"
            ]
          },
          {
            "label": "MCP http server",
            "body": "{\n  \"mcpServers\": {\n    \"server-name\": {\n      \"type\": \"http\",\n      \"url\": \"http://localhost:3000/mcp\"\n    }\n  }\n}",
            "docs": "HTTP server configuration scaffold.",
            "rules": [
              "MCP-010",
              "MCP-011"
            ]
          }
        ]
      },
      {
        "id": "copilot",
        "keys": [
          {
            "key": "applyTo",
            "docs": "Glob pattern selecting files for scoped instruction.",
            "rules": [
              "COP-002",
              "COP-003",
              "COP-004"
            ],
            "values": [
              "**/*.ts",
              "**/*.rs",
              "**/*.py"
            ],
            "snippet": "applyTo: \"**/*.ts\""
          },
          {
            "key": "excludeAgent",
            "docs": "Exclude a specific Copilot agent from this scoped instruction.",
            "rules": [
              "COP-005"
            ],
            "values": [
              "code-review",
              "coding-agent"
            ],
            "snippet": "excludeAgent: \"code-review\""
          }
        ],
        "snippets": [
          {
            "label": "Copilot scoped frontmatter",
            "body": "---\napplyTo: \"**/*.ts\"\n---\n",
            "docs": "Scoped Copilot instruction frontmatter.",
            "rules": [
              "COP-002",
              "COP-003"
            ]
          }
        ]
      },
      {
        "id": "cursor",
        "keys": [
          {
            "key": "description",
            "docs": "Human-readable rule summary.",
            "rules": [
              "CUR-003"
            ],
            "values": [],
            "snippet": "description: TypeScript rules"
          },
          {
            "key": "globs",
            "docs": "Glob pattern(s) selecting files for this rule.",
            "rules": [
              "CUR-004",
              "CUR-005"
            ],
            "values": [
              "**/*.ts",
              "**/*.tsx",
              "**/*.rs"
            ],
            "snippet": "globs: \"**/*.ts\""
          },
          {
            "key": "alwaysApply",
            "docs": "Always apply this rule regardless of filename matching.",
            "rules": [
              "CUR-005"
            ],
            "values": [
              "true",
              "false"
            ],
            "snippet": "alwaysApply: false"
          }
        ],
        "snippets": [
          {
            "label": "Cursor .mdc frontmatter",
            "body": "---\ndescription: TypeScript rules\nglobs: \"**/*.ts\"\nalwaysApply: false\n---\n",
            "docs": "Cursor rule frontmatter scaffold.",
            "rules": [
              "CUR-003",
              "CUR-004",
              "CUR-005"
            ]
          }
        ]
      },
      {
        "id": "claude-agents",
        "keys": [],
        "snippets": [
          {
            "label": "Project Context section",
            "body": "## Project Context\nDescribe the repository purpose, architecture, and constraints.\n",
            "docs": "Recommended AGENTS/CLAUDE section scaffold.",
            "rules": [
              "AGM-004"
            ]
          },
          {
            "label": "Workflow section",
            "body": "## Workflow\n1. Explore current state\n2. Implement minimal safe changes\n3. Run tests and report results\n",
            "docs": "Workflow scaffold for agent guidance docs.",
            "rules": [
              "AGM-002"
            ]
          },
          {
            "label": "Code comment directive",
            "body": "::code-comment{title=\"[P2] Issue\" body=\"Describe the issue clearly.\" file=\"/path/to/file\" start=1 end=1}",
            "docs": "Inline review directive scaffold.",
            "rules": [
              "AGM-001"
            ]
          }
        ]
      }
    ]
  }
}
